Merge from head

158 files changed, 1211 insertions, 888 deletions

diff --git a/usr.sbin/acpi/acpiconf/acpiconf.c b/usr.sbin/acpi/acpiconf/acpiconf.c
index 5ca2f98..1fab4b6 100644
--- a/usr.sbin/acpi/acpiconf/acpiconf.c
+++ b/usr.sbin/acpi/acpiconf/acpiconf.c
@@ -136,16 +136,30 @@ acpi_battinfo(int num)
 	if (ioctl(acpifd, ACPIIO_BATT_GET_BATTINFO, &battio) == -1)
 		err(EX_IOERR, "get battery user info (%d) failed", num);
 	if (battio.battinfo.state != ACPI_BATT_STAT_NOT_PRESENT) {
-		printf("State:\t\t\t");
-		if (battio.battinfo.state == 0)
-			printf("high ");
-		if (battio.battinfo.state & ACPI_BATT_STAT_CRITICAL)
-			printf("critical ");
-		if (battio.battinfo.state & ACPI_BATT_STAT_DISCHARG)
-			printf("discharging ");
-		if (battio.battinfo.state & ACPI_BATT_STAT_CHARGING)
-			printf("charging ");
-		printf("\n");
+		const char *state;
+		switch (battio.battinfo.state & ACPI_BATT_STAT_BST_MASK) {
+		case 0:
+			state = "high";
+			break;
+		case ACPI_BATT_STAT_DISCHARG:
+			state = "discharging";
+			break;
+		case ACPI_BATT_STAT_CHARGING:
+			state = "charging";
+			break;
+		case ACPI_BATT_STAT_CRITICAL:
+			state = "critical";
+			break;
+		case ACPI_BATT_STAT_DISCHARG | ACPI_BATT_STAT_CRITICAL:
+			state = "critical discharging";
+			break;
+		case ACPI_BATT_STAT_CHARGING | ACPI_BATT_STAT_CRITICAL:
+			state = "critical charging";
+			break;
+		default:
+			state = "invalid";
+		}
+		printf("State:\t\t\t%s\n", state);
 		if (battio.battinfo.cap == -1)
 			printf("Remaining capacity:\tunknown\n");
 		else
diff --git a/usr.sbin/acpi/acpidump/acpi.c b/usr.sbin/acpi/acpidump/acpi.c
index ae7ebf2..52a9e8a 100644
--- a/usr.sbin/acpi/acpidump/acpi.c
+++ b/usr.sbin/acpi/acpidump/acpi.c
@@ -168,12 +168,18 @@ acpi_print_gas(ACPI_GENERIC_ADDRESS *gas)
 {
 	switch(gas->SpaceId) {
 	case ACPI_GAS_MEMORY:
-		printf("0x%08lx:%u[%u] (Memory)", (u_long)gas->Address,
-		       gas->BitOffset, gas->BitWidth);
+		if (gas->BitWidth <= 32)
+			printf("0x%08x:%u[%u] (Memory)",
+			    (u_int)gas->Address, gas->BitOffset,
+			    gas->BitWidth);
+		else
+			printf("0x%016jx:%u[%u] (Memory)",
+			    (uintmax_t)gas->Address, gas->BitOffset,
+			    gas->BitWidth);
 		break;
 	case ACPI_GAS_IO:
-		printf("0x%02lx:%u[%u] (IO)", (u_long)gas->Address,
-		       gas->BitOffset, gas->BitWidth);
+		printf("0x%02x:%u[%u] (IO)", (u_int)gas->Address,
+		    gas->BitOffset, gas->BitWidth);
 		break;
 	case ACPI_GAS_PCI:
 		printf("%x:%x+0x%x (PCI)", (uint16_t)(gas->Address >> 32),
@@ -194,7 +200,7 @@ acpi_print_gas(ACPI_GENERIC_ADDRESS *gas)
 	case ACPI_GAS_DATATABLE:
 	case ACPI_GAS_FIXED:
 	default:
-		printf("0x%08lx (?)", (u_long)gas->Address);
+		printf("0x%016jx (?)", (uintmax_t)gas->Address);
 		break;
 	}
 }
@@ -831,7 +837,7 @@ acpi_handle_dmar_drhd(ACPI_DMAR_HARDWARE_UNIT *drhd)
 #undef PRINTFLAG
 
 	printf("\tSegment=%d\n", drhd->Segment);
-	printf("\tAddress=0x%0jx\n", (uintmax_t)drhd->Address);
+	printf("\tAddress=0x%016jx\n", (uintmax_t)drhd->Address);
 
 	remaining = drhd->Header.Length - sizeof(ACPI_DMAR_HARDWARE_UNIT);
 	if (remaining > 0)
@@ -856,8 +862,8 @@ acpi_handle_dmar_rmrr(ACPI_DMAR_RESERVED_MEMORY *rmrr)
 	printf("\tType=RMRR\n");
 	printf("\tLength=%d\n", rmrr->Header.Length);
 	printf("\tSegment=%d\n", rmrr->Segment);
-	printf("\tBaseAddress=0x%0jx\n", (uintmax_t)rmrr->BaseAddress);
-	printf("\tLimitAddress=0x%0jx\n", (uintmax_t)rmrr->EndAddress);
+	printf("\tBaseAddress=0x%016jx\n", (uintmax_t)rmrr->BaseAddress);
+	printf("\tLimitAddress=0x%016jx\n", (uintmax_t)rmrr->EndAddress);
 
 	remaining = rmrr->Header.Length - sizeof(ACPI_DMAR_RESERVED_MEMORY);
 	if (remaining > 0)
@@ -912,7 +918,7 @@ acpi_handle_dmar_rhsa(ACPI_DMAR_RHSA *rhsa)
 	printf("\n");
 	printf("\tType=RHSA\n");
 	printf("\tLength=%d\n", rhsa->Header.Length);
-	printf("\tBaseAddress=0x%0jx\n", (uintmax_t)rhsa->BaseAddress);
+	printf("\tBaseAddress=0x%016jx\n", (uintmax_t)rhsa->BaseAddress);
 	printf("\tProximityDomain=0x%08x\n", rhsa->ProximityDomain);
 }
 
@@ -1074,7 +1080,6 @@ acpi_print_rsdt(ACPI_TABLE_HEADER *rsdp)
 	ACPI_TABLE_RSDT *rsdt;
 	ACPI_TABLE_XSDT *xsdt;
 	int	i, entries;
-	u_long	addr;
 
 	rsdt = (ACPI_TABLE_RSDT *)rsdp;
 	xsdt = (ACPI_TABLE_XSDT *)rsdp;
@@ -1085,18 +1090,11 @@ acpi_print_rsdt(ACPI_TABLE_HEADER *rsdp)
 	for (i = 0; i < entries; i++) {
 		if (i > 0)
 			printf(", ");
-		switch (addr_size) {
-		case 4:
-			addr = le32toh(rsdt->TableOffsetEntry[i]);
-			break;
-		case 8:
-			addr = le64toh(xsdt->TableOffsetEntry[i]);
-			break;
-		default:
-			addr = 0;
-		}
-		assert(addr != 0);
-		printf("0x%08lx", addr);
+		if (addr_size == 4)
+			printf("0x%08x", le32toh(rsdt->TableOffsetEntry[i]));
+		else
+			printf("0x%016jx",
+			    (uintmax_t)le64toh(xsdt->TableOffsetEntry[i]));
 	}
 	printf(" }\n");
 	printf(END_COMMENT);
@@ -1212,8 +1210,8 @@ acpi_print_fadt(ACPI_TABLE_HEADER *sdp)
 		printf(", RESET_VALUE=%#x\n", fadt->ResetValue);
 	}
 	if (acpi_get_fadt_revision(fadt) > 1) {
-		printf("\tX_FACS=0x%08lx, ", (u_long)fadt->XFacs);
-		printf("X_DSDT=0x%08lx\n", (u_long)fadt->XDsdt);
+		printf("\tX_FACS=0x%016jx, ", (uintmax_t)fadt->XFacs);
+		printf("X_DSDT=0x%016jx\n", (uintmax_t)fadt->XDsdt);
 		printf("\tX_PM1a_EVT_BLK=");
 		acpi_print_gas(&fadt->XPm1aEventBlock);
 		if (fadt->XPm1bEventBlock.Address != 0) {
@@ -1268,10 +1266,9 @@ acpi_print_facs(ACPI_TABLE_FACS *facs)
 		printf("S4BIOS");
 	printf("\n");
 
-	if (facs->XFirmwareWakingVector != 0) {
-		printf("\tX_Firm_Wake_Vec=%08lx\n",
-		       (u_long)facs->XFirmwareWakingVector);
-	}
+	if (facs->XFirmwareWakingVector != 0)
+		printf("\tX_Firm_Wake_Vec=%016jx\n",
+		    (uintmax_t)facs->XFirmwareWakingVector);
 	printf("\tVersion=%u\n", facs->Version);
 
 	printf(END_COMMENT);
@@ -1321,8 +1318,8 @@ acpi_print_rsd_ptr(ACPI_TABLE_RSDP *rp)
 		printf("\tRSDT=0x%08x, cksum=%u\n", rp->RsdtPhysicalAddress,
 		    rp->Checksum);
 	} else {
-		printf("\tXSDT=0x%08lx, length=%u, cksum=%u\n",
-		    (u_long)rp->XsdtPhysicalAddress, rp->Length,
+		printf("\tXSDT=0x%016jx, length=%u, cksum=%u\n",
+		    (uintmax_t)rp->XsdtPhysicalAddress, rp->Length,
 		    rp->ExtendedChecksum);
 	}
 	printf(END_COMMENT);
@@ -1342,17 +1339,12 @@ acpi_handle_rsdt(ACPI_TABLE_HEADER *rsdp)
 	xsdt = (ACPI_TABLE_XSDT *)rsdp;
 	entries = (rsdp->Length - sizeof(ACPI_TABLE_HEADER)) / addr_size;
 	for (i = 0; i < entries; i++) {
-		switch (addr_size) {
-		case 4:
+		if (addr_size == 4)
 			addr = le32toh(rsdt->TableOffsetEntry[i]);
-			break;
-		case 8:
+		else
 			addr = le64toh(xsdt->TableOffsetEntry[i]);
-			break;
-		default:
-			assert((addr = 0));
-		}
-
+		if (addr == 0)
+			continue;
 		sdp = (ACPI_TABLE_HEADER *)acpi_map_sdt(addr);
 		if (acpi_checksum(sdp, sdp->Length)) {
 			warnx("RSDT entry %d (sig %.4s) is corrupt", i,
@@ -1547,16 +1539,12 @@ sdt_from_rsdt(ACPI_TABLE_HEADER *rsdp, const char *sig, ACPI_TABLE_HEADER *last)
 	xsdt = (ACPI_TABLE_XSDT *)rsdp;
 	entries = (rsdp->Length - sizeof(ACPI_TABLE_HEADER)) / addr_size;
 	for (i = 0; i < entries; i++) {
-		switch (addr_size) {
-		case 4:
+		if (addr_size == 4)
 			addr = le32toh(rsdt->TableOffsetEntry[i]);
-			break;
-		case 8:
+		else
 			addr = le64toh(xsdt->TableOffsetEntry[i]);
-			break;
-		default:
-			assert((addr = 0));
-		}
+		if (addr == 0)
+			continue;
 		sdt = (ACPI_TABLE_HEADER *)acpi_map_sdt(addr);
 		if (last != NULL) {
 			if (sdt == last)
diff --git a/usr.sbin/amd/include/config.h b/usr.sbin/amd/include/config.h
index 5817a46..cffb82a 100644
--- a/usr.sbin/amd/include/config.h
+++ b/usr.sbin/amd/include/config.h
@@ -668,9 +668,6 @@
 /* Define to 1 if you have the <net/if.h> header file. */
 #define HAVE_NET_IF_H 1
 
-/* Define to 1 if you have the <net/if_var.h> header file. */
-#define HAVE_NET_IF_VAR_H 1
-
 /* Define to 1 if you have the <net/route.h> header file. */
 #define HAVE_NET_ROUTE_H 1
 
diff --git a/usr.sbin/ancontrol/ancontrol.c b/usr.sbin/ancontrol/ancontrol.c
index 839cdcb..4ff32ff 100644
--- a/usr.sbin/ancontrol/ancontrol.c
+++ b/usr.sbin/ancontrol/ancontrol.c
@@ -46,7 +46,6 @@ __FBSDID("$FreeBSD$");
 #include <arpa/inet.h>
 
 #include <net/if.h>
-#include <net/if_var.h>
 #include <net/ethernet.h>
 
 #include <dev/an/if_aironet_ieee.h>
diff --git a/usr.sbin/authpf/Makefile b/usr.sbin/authpf/Makefile
index 07b2cdc..be95a4b 100644
--- a/usr.sbin/authpf/Makefile
+++ b/usr.sbin/authpf/Makefile
@@ -13,7 +13,7 @@ SRCS=   authpf.c
 # XXX ALTQ:
 CFLAGS+= -DENABLE_ALTQ
 
-LIBADD=	m md util
+LIBADD=	m util
 
 WARNS?=	3
 
diff --git a/usr.sbin/bhyve/Makefile b/usr.sbin/bhyve/Makefile
index 0273b0f..70b7041 100644
--- a/usr.sbin/bhyve/Makefile
+++ b/usr.sbin/bhyve/Makefile
@@ -44,7 +44,7 @@ SRCS=	\
 .PATH:	${.CURDIR}/../../sys/amd64/vmm
 SRCS+=	vmm_instruction_emul.c
 
-LIBADD=	vmmapi md util pthread
+LIBADD=	vmmapi md pthread
 
 WARNS?=	2
 
diff --git a/usr.sbin/bhyve/acpi.c b/usr.sbin/bhyve/acpi.c
index a5a6559..a9dd1cc 100644
--- a/usr.sbin/bhyve/acpi.c
+++ b/usr.sbin/bhyve/acpi.c
@@ -386,7 +386,7 @@ basl_fwrite_fadt(FILE *fp)
 	EFPRINTF(fp, "[0001]\t\tDuty Cycle Width : 00\n");
 	EFPRINTF(fp, "[0001]\t\tRTC Day Alarm Index : 00\n");
 	EFPRINTF(fp, "[0001]\t\tRTC Month Alarm Index : 00\n");
-	EFPRINTF(fp, "[0001]\t\tRTC Century Index : 00\n");
+	EFPRINTF(fp, "[0001]\t\tRTC Century Index : 32\n");
 	EFPRINTF(fp, "[0002]\t\tBoot Flags (decoded below) : 0000\n");
 	EFPRINTF(fp, "\t\t\tLegacy Devices Supported (V2) : 0\n");
 	EFPRINTF(fp, "\t\t\t8042 Present on ports 60/64 (V2) : 0\n");
diff --git a/usr.sbin/bhyve/bhyverun.c b/usr.sbin/bhyve/bhyverun.c
index 271f67c..47a7699 100644
--- a/usr.sbin/bhyve/bhyverun.c
+++ b/usr.sbin/bhyve/bhyverun.c
@@ -325,8 +325,10 @@ vmexit_inout(struct vmctx *ctx, struct vm_exit *vme, int *pvcpu)
 
 	error = emulate_inout(ctx, vcpu, vme, strictio);
 	if (error) {
-		fprintf(stderr, "Unhandled %s%c 0x%04x\n", in ? "in" : "out",
-		    bytes == 1 ? 'b' : (bytes == 2 ? 'w' : 'l'), port);
+		fprintf(stderr, "Unhandled %s%c 0x%04x at 0x%lx\n",
+		    in ? "in" : "out",
+		    bytes == 1 ? 'b' : (bytes == 2 ? 'w' : 'l'),
+		    port, vmexit->rip);
 		return (VMEXIT_ABORT);
 	} else {
 		return (VMEXIT_CONTINUE);
@@ -803,6 +805,11 @@ main(int argc, char *argv[])
 		exit(1);
 	}
 
+	if (guest_ncpus < 1) {
+		fprintf(stderr, "Invalid guest vCPUs (%d)\n", guest_ncpus);
+		exit(1);
+	}
+
 	max_vcpus = num_vcpus_allowed(ctx);
 	if (guest_ncpus > max_vcpus) {
 		fprintf(stderr, "%d vCPUs requested but only %d available\n",
diff --git a/usr.sbin/bhyve/block_if.c b/usr.sbin/bhyve/block_if.c
index b8b27a6..bcb1617 100644
--- a/usr.sbin/bhyve/block_if.c
+++ b/usr.sbin/bhyve/block_if.c
@@ -85,6 +85,7 @@ struct blockif_ctxt {
 	int			bc_magic;
 	int			bc_fd;
 	int			bc_ischr;
+	int			bc_isgeom;
 	int			bc_candelete;
 	int			bc_rdonly;
 	off_t			bc_size;
@@ -198,27 +199,93 @@ blockif_complete(struct blockif_ctxt *bc, struct blockif_elem *be)
 }
 
 static void
-blockif_proc(struct blockif_ctxt *bc, struct blockif_elem *be)
+blockif_proc(struct blockif_ctxt *bc, struct blockif_elem *be, uint8_t *buf)
 {
 	struct blockif_req *br;
 	off_t arg[2];
-	int err;
+	ssize_t clen, len, off, boff, voff;
+	int i, err;
 
 	br = be->be_req;
+	if (br->br_iovcnt <= 1)
+		buf = NULL;
 	err = 0;
-
 	switch (be->be_op) {
 	case BOP_READ:
-		if (preadv(bc->bc_fd, br->br_iov, br->br_iovcnt,
-			   br->br_offset) < 0)
-			err = errno;
+		if (buf == NULL) {
+			if ((len = preadv(bc->bc_fd, br->br_iov, br->br_iovcnt,
+				   br->br_offset)) < 0)
+				err = errno;
+			else
+				br->br_resid -= len;
+			break;
+		}
+		i = 0;
+		off = voff = 0;
+		while (br->br_resid > 0) {
+			len = MIN(br->br_resid, MAXPHYS);
+			if (pread(bc->bc_fd, buf, len, br->br_offset +
+			    off) < 0) {
+				err = errno;
+				break;
+			}
+			boff = 0;
+			do {
+				clen = MIN(len - boff, br->br_iov[i].iov_len -
+				    voff);
+				memcpy(br->br_iov[i].iov_base + voff,
+				    buf + boff, clen);
+				if (clen < br->br_iov[i].iov_len - voff)
+					voff += clen;
+				else {
+					i++;
+					voff = 0;
+				}
+				boff += clen;
+			} while (boff < len);
+			off += len;
+			br->br_resid -= len;
+		}
 		break;
 	case BOP_WRITE:
-		if (bc->bc_rdonly)
+		if (bc->bc_rdonly) {
 			err = EROFS;
-		else if (pwritev(bc->bc_fd, br->br_iov, br->br_iovcnt,
-			     br->br_offset) < 0)
-			err = errno;
+			break;
+		}
+		if (buf == NULL) {
+			if ((len = pwritev(bc->bc_fd, br->br_iov, br->br_iovcnt,
+				    br->br_offset)) < 0)
+				err = errno;
+			else
+				br->br_resid -= len;
+			break;
+		}
+		i = 0;
+		off = voff = 0;
+		while (br->br_resid > 0) {
+			len = MIN(br->br_resid, MAXPHYS);
+			boff = 0;
+			do {
+				clen = MIN(len - boff, br->br_iov[i].iov_len -
+				    voff);
+				memcpy(buf + boff,
+				    br->br_iov[i].iov_base + voff, clen);
+				if (clen < br->br_iov[i].iov_len - voff)
+					voff += clen;
+				else {
+					i++;
+					voff = 0;
+				}
+				boff += clen;
+			} while (boff < len);
+			if (pwrite(bc->bc_fd, buf, len, br->br_offset +
+			    off) < 0) {
+				err = errno;
+				break;
+			}
+			off += len;
+			br->br_resid -= len;
+		}
 		break;
 	case BOP_FLUSH:
 		if (bc->bc_ischr) {
@@ -234,9 +301,11 @@ blockif_proc(struct blockif_ctxt *bc, struct blockif_elem *be)
 			err = EROFS;
 		else if (bc->bc_ischr) {
 			arg[0] = br->br_offset;
-			arg[1] = br->br_iov[0].iov_len;
+			arg[1] = br->br_resid;
 			if (ioctl(bc->bc_fd, DIOCGDELETE, arg))
 				err = errno;
+			else
+				br->br_resid = 0;
 		} else
 			err = EOPNOTSUPP;
 		break;
@@ -256,15 +325,20 @@ blockif_thr(void *arg)
 	struct blockif_ctxt *bc;
 	struct blockif_elem *be;
 	pthread_t t;
+	uint8_t *buf;
 
 	bc = arg;
+	if (bc->bc_isgeom)
+		buf = malloc(MAXPHYS);
+	else
+		buf = NULL;
 	t = pthread_self();
 
 	pthread_mutex_lock(&bc->bc_mtx);
 	for (;;) {
 		while (blockif_dequeue(bc, t, &be)) {
 			pthread_mutex_unlock(&bc->bc_mtx);
-			blockif_proc(bc, be);
+			blockif_proc(bc, be, buf);
 			pthread_mutex_lock(&bc->bc_mtx);
 			blockif_complete(bc, be);
 		}
@@ -275,6 +349,8 @@ blockif_thr(void *arg)
 	}
 	pthread_mutex_unlock(&bc->bc_mtx);
 
+	if (buf)
+		free(buf);
 	pthread_exit(NULL);
 	return (NULL);
 }
@@ -315,13 +391,14 @@ struct blockif_ctxt *
 blockif_open(const char *optstr, const char *ident)
 {
 	char tname[MAXCOMLEN + 1];
+	char name[MAXPATHLEN];
 	char *nopt, *xopts;
 	struct blockif_ctxt *bc;
 	struct stat sbuf;
 	struct diocgattr_arg arg;
 	off_t size, psectsz, psectoff;
 	int extra, fd, i, sectsz;
-	int nocache, sync, ro, candelete;
+	int nocache, sync, ro, candelete, geom;
 
 	pthread_once(&blockif_once, blockif_init);
 
@@ -375,7 +452,7 @@ blockif_open(const char *optstr, const char *ident)
         size = sbuf.st_size;
 	sectsz = DEV_BSIZE;
 	psectsz = psectoff = 0;
-	candelete = 0;
+	candelete = geom = 0;
 	if (S_ISCHR(sbuf.st_mode)) {
 		if (ioctl(fd, DIOCGMEDIASIZE, &size) < 0 ||
 		    ioctl(fd, DIOCGSECTORSIZE, &sectsz)) {
@@ -391,6 +468,8 @@ blockif_open(const char *optstr, const char *ident)
 		arg.len = sizeof(arg.value.i);
 		if (ioctl(fd, DIOCGATTR, &arg) == 0)
 			candelete = arg.value.i;
+		if (ioctl(fd, DIOCGPROVIDERNAME, name) == 0)
+			geom = 1;
 	} else
 		psectsz = sbuf.st_blksize;
 
@@ -403,6 +482,7 @@ blockif_open(const char *optstr, const char *ident)
 	bc->bc_magic = BLOCKIF_SIG;
 	bc->bc_fd = fd;
 	bc->bc_ischr = S_ISCHR(sbuf.st_mode);
+	bc->bc_isgeom = geom;
 	bc->bc_candelete = candelete;
 	bc->bc_rdonly = ro;
 	bc->bc_size = size;
diff --git a/usr.sbin/bhyve/block_if.h b/usr.sbin/bhyve/block_if.h
index 1cb7c80..8e63407 100644
--- a/usr.sbin/bhyve/block_if.h
+++ b/usr.sbin/bhyve/block_if.h
@@ -45,6 +45,7 @@ struct blockif_req {
 	struct iovec	br_iov[BLOCKIF_IOV_MAX];
 	int		br_iovcnt;
 	off_t		br_offset;
+	ssize_t		br_resid;
 	void		(*br_callback)(struct blockif_req *req, int err);
 	void		*br_param;
 };
diff --git a/usr.sbin/bhyve/ioapic.c b/usr.sbin/bhyve/ioapic.c
index 2950d9a..0ad69d9 100644
--- a/usr.sbin/bhyve/ioapic.c
+++ b/usr.sbin/bhyve/ioapic.c
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 2014 Advanced Computing Technologies LLC
+ * Copyright (c) 2014 Hudson River Trading LLC
  * Written by: John H. Baldwin <jhb@FreeBSD.org>
  * All rights reserved.
  *
diff --git a/usr.sbin/bhyve/ioapic.h b/usr.sbin/bhyve/ioapic.h
index 3cfca4f..efdd3c6 100644
--- a/usr.sbin/bhyve/ioapic.h
+++ b/usr.sbin/bhyve/ioapic.h
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 2014 Advanced Computing Technologies LLC
+ * Copyright (c) 2014 Hudson River Trading LLC
  * Written by: John H. Baldwin <jhb@FreeBSD.org>
  * All rights reserved.
  *
diff --git a/usr.sbin/bhyve/pci_ahci.c b/usr.sbin/bhyve/pci_ahci.c
index e8cb2da..2d05789 100644
--- a/usr.sbin/bhyve/pci_ahci.c
+++ b/usr.sbin/bhyve/pci_ahci.c
@@ -124,7 +124,7 @@ struct ahci_ioreq {
 	uint32_t len;
 	uint32_t done;
 	int slot;
-	int prdtl;
+	int more;
 };
 
 struct ahci_port {
@@ -269,22 +269,24 @@ ahci_write_fis(struct ahci_port *p, enum sata_fis_type ft, uint8_t *fis)
 	case FIS_TYPE_REGD2H:
 		offset = 0x40;
 		len = 20;
-		irq = AHCI_P_IX_DHR;
+		irq = (fis[1] & (1 << 6)) ? AHCI_P_IX_DHR : 0;
 		break;
 	case FIS_TYPE_SETDEVBITS:
 		offset = 0x58;
 		len = 8;
-		irq = AHCI_P_IX_SDB;
+		irq = (fis[1] & (1 << 6)) ? AHCI_P_IX_SDB : 0;
 		break;
 	case FIS_TYPE_PIOSETUP:
 		offset = 0x20;
 		len = 20;
-		irq = 0;
+		irq = (fis[1] & (1 << 6)) ? AHCI_P_IX_PS : 0;
 		break;
 	default:
 		WPRINTF("unsupported fis type %d\n", ft);
 		return;
 	}
+	if (fis[2] & ATA_S_ERROR)
+		irq |= AHCI_P_IX_TFE;
 	memcpy(p->rfis + offset, fis, len);
 	if (irq) {
 		p->is |= irq;
@@ -309,22 +311,23 @@ ahci_write_fis_sdb(struct ahci_port *p, int slot, uint8_t *cfis, uint32_t tfd)
 	uint8_t error;
 
 	error = (tfd >> 8) & 0xff;
+	tfd &= 0x77;
 	memset(fis, 0, sizeof(fis));
 	fis[0] = FIS_TYPE_SETDEVBITS;
 	fis[1] = (1 << 6);
-	fis[2] = tfd & 0x77;
+	fis[2] = tfd;
 	fis[3] = error;
 	if (fis[2] & ATA_S_ERROR) {
-		p->is |= AHCI_P_IX_TFE;
 		p->err_cfis[0] = slot;
-		p->err_cfis[2] = tfd & 0x77;
+		p->err_cfis[2] = tfd;
 		p->err_cfis[3] = error;
 		memcpy(&p->err_cfis[4], cfis + 4, 16);
 	} else {
 		*(uint32_t *)(fis + 4) = (1 << slot);
 		p->sact &= ~(1 << slot);
 	}
-	p->tfd = tfd;
+	p->tfd &= ~0x77;
+	p->tfd |= tfd;
 	ahci_write_fis(p, FIS_TYPE_SETDEVBITS, fis);
 }
 
@@ -351,7 +354,6 @@ ahci_write_fis_d2h(struct ahci_port *p, int slot, uint8_t *cfis, uint32_t tfd)
 	fis[12] = cfis[12];
 	fis[13] = cfis[13];
 	if (fis[2] & ATA_S_ERROR) {
-		p->is |= AHCI_P_IX_TFE;
 		p->err_cfis[0] = 0x80;
 		p->err_cfis[2] = tfd & 0xff;
 		p->err_cfis[3] = error;
@@ -363,6 +365,21 @@ ahci_write_fis_d2h(struct ahci_port *p, int slot, uint8_t *cfis, uint32_t tfd)
 }
 
 static void
+ahci_write_fis_d2h_ncq(struct ahci_port *p, int slot)
+{
+	uint8_t fis[20];
+
+	p->tfd = ATA_S_READY | ATA_S_DSC;
+	memset(fis, 0, sizeof(fis));
+	fis[0] = FIS_TYPE_REGD2H;
+	fis[1] = 0;			/* No interrupt */
+	fis[2] = p->tfd;		/* Status */
+	fis[3] = 0;			/* No error */
+	p->ci &= ~(1 << slot);
+	ahci_write_fis(p, FIS_TYPE_REGD2H, fis);
+}
+
+static void
 ahci_write_reset_fis_d2h(struct ahci_port *p)
 {
 	uint8_t fis[20];
@@ -418,7 +435,8 @@ ahci_port_stop(struct ahci_port *p)
 		slot = aior->slot;
 		cfis = aior->cfis;
 		if (cfis[2] == ATA_WRITE_FPDMA_QUEUED ||
-		    cfis[2] == ATA_READ_FPDMA_QUEUED)
+		    cfis[2] == ATA_READ_FPDMA_QUEUED ||
+		    cfis[2] == ATA_SEND_FPDMA_QUEUED)
 			ncq = 1;
 
 		if (ncq)
@@ -489,6 +507,9 @@ ahci_reset(struct pci_ahci_softc *sc)
 	for (i = 0; i < sc->ports; i++) {
 		sc->port[i].ie = 0;
 		sc->port[i].is = 0;
+		sc->port[i].cmd = (AHCI_P_CMD_SUD | AHCI_P_CMD_POD);
+		if (sc->port[i].bctx)
+			sc->port[i].cmd |= AHCI_P_CMD_CPS;
 		sc->port[i].sctl = 0;
 		ahci_port_reset(&sc->port[i]);
 	}
@@ -520,26 +541,79 @@ atapi_string(uint8_t *dest, const char *src, int len)
 	}
 }
 
+/*
+ * Build up the iovec based on the PRDT, 'done' and 'len'.
+ */
+static void
+ahci_build_iov(struct ahci_port *p, struct ahci_ioreq *aior,
+    struct ahci_prdt_entry *prdt, uint16_t prdtl)
+{
+	struct blockif_req *breq = &aior->io_req;
+	int i, j, skip, todo, left, extra;
+	uint32_t dbcsz;
+
+	/* Copy part of PRDT between 'done' and 'len' bytes into the iov. */
+	skip = aior->done;
+	left = aior->len - aior->done;
+	todo = 0;
+	for (i = 0, j = 0; i < prdtl && j < BLOCKIF_IOV_MAX && left > 0;
+	    i++, prdt++) {
+		dbcsz = (prdt->dbc & DBCMASK) + 1;
+		/* Skip already done part of the PRDT */
+		if (dbcsz <= skip) {
+			skip -= dbcsz;
+			continue;
+		}
+		dbcsz -= skip;
+		if (dbcsz > left)
+			dbcsz = left;
+		breq->br_iov[j].iov_base = paddr_guest2host(ahci_ctx(p->pr_sc),
+		    prdt->dba + skip, dbcsz);
+		breq->br_iov[j].iov_len = dbcsz;
+		todo += dbcsz;
+		left -= dbcsz;
+		skip = 0;
+		j++;
+	}
+
+	/* If we got limited by IOV length, round I/O down to sector size. */
+	if (j == BLOCKIF_IOV_MAX) {
+		extra = todo % blockif_sectsz(p->bctx);
+		todo -= extra;
+		assert(todo > 0);
+		while (extra > 0) {
+			if (breq->br_iov[j - 1].iov_len > extra) {
+				breq->br_iov[j - 1].iov_len -= extra;
+				break;
+			}
+			extra -= breq->br_iov[j - 1].iov_len;
+			j--;
+		}
+	}
+
+	breq->br_iovcnt = j;
+	breq->br_resid = todo;
+	aior->done += todo;
+	aior->more = (aior->done < aior->len && i < prdtl);
+}
+
 static void
-ahci_handle_dma(struct ahci_port *p, int slot, uint8_t *cfis, uint32_t done,
-    int seek)
+ahci_handle_rw(struct ahci_port *p, int slot, uint8_t *cfis, uint32_t done)
 {
 	struct ahci_ioreq *aior;
 	struct blockif_req *breq;
-	struct pci_ahci_softc *sc;
 	struct ahci_prdt_entry *prdt;
 	struct ahci_cmd_hdr *hdr;
 	uint64_t lba;
 	uint32_t len;
-	int i, err, iovcnt, ncq, readop;
+	int err, first, ncq, readop;
 
-	sc = p->pr_sc;
 	prdt = (struct ahci_prdt_entry *)(cfis + 0x80);
 	hdr = (struct ahci_cmd_hdr *)(p->cmd_lst + slot * AHCI_CL_SIZE);
 	ncq = 0;
 	readop = 1;
+	first = (done == 0);
 
-	prdt += seek;
 	if (cfis[2] == ATA_WRITE || cfis[2] == ATA_WRITE48 ||
 	    cfis[2] == ATA_WRITE_MUL || cfis[2] == ATA_WRITE_MUL48 ||
 	    cfis[2] == ATA_WRITE_DMA || cfis[2] == ATA_WRITE_DMA48 ||
@@ -580,57 +654,33 @@ ahci_handle_dma(struct ahci_port *p, int slot, uint8_t *cfis, uint32_t done,
 	lba *= blockif_sectsz(p->bctx);
 	len *= blockif_sectsz(p->bctx);
 
-	/*
-	 * Pull request off free list
-	 */
+	/* Pull request off free list */
 	aior = STAILQ_FIRST(&p->iofhd);
 	assert(aior != NULL);
 	STAILQ_REMOVE_HEAD(&p->iofhd, io_flist);
+
 	aior->cfis = cfis;
 	aior->slot = slot;
 	aior->len = len;
 	aior->done = done;
 	breq = &aior->io_req;
 	breq->br_offset = lba + done;
-	iovcnt = hdr->prdtl - seek;
-	if (iovcnt > BLOCKIF_IOV_MAX) {
-		aior->prdtl = iovcnt - BLOCKIF_IOV_MAX;
-		iovcnt = BLOCKIF_IOV_MAX;
-	} else
-		aior->prdtl = 0;
-	breq->br_iovcnt = iovcnt;
+	ahci_build_iov(p, aior, prdt, hdr->prdtl);
 
-	/*
-	 * Mark this command in-flight.
-	 */
+	/* Mark this command in-flight. */
 	p->pending |= 1 << slot;
 
-	/*
-	 * Stuff request onto busy list
-	 */
+	/* Stuff request onto busy list. */
 	TAILQ_INSERT_HEAD(&p->iobhd, aior, io_blist);
 
-	/*
-	 * Build up the iovec based on the prdt
-	 */
-	for (i = 0; i < iovcnt; i++) {
-		uint32_t dbcsz;
+	if (ncq && first)
+		ahci_write_fis_d2h_ncq(p, slot);
 
-		dbcsz = (prdt->dbc & DBCMASK) + 1;
-		breq->br_iov[i].iov_base = paddr_guest2host(ahci_ctx(sc),
-		    prdt->dba, dbcsz);
-		breq->br_iov[i].iov_len = dbcsz;
-		aior->done += dbcsz;
-		prdt++;
-	}
 	if (readop)
 		err = blockif_read(p->bctx, breq);
 	else
 		err = blockif_write(p->bctx, breq);
 	assert(err == 0);
-
-	if (ncq)
-		p->ci &= ~(1 << slot);
 }
 
 static void
@@ -650,7 +700,7 @@ ahci_handle_flush(struct ahci_port *p, int slot, uint8_t *cfis)
 	aior->slot = slot;
 	aior->len = 0;
 	aior->done = 0;
-	aior->prdtl = 0;
+	aior->more = 0;
 	breq = &aior->io_req;
 
 	/*
@@ -703,15 +753,18 @@ ahci_handle_dsm_trim(struct ahci_port *p, int slot, uint8_t *cfis, uint32_t done
 	uint8_t *entry;
 	uint64_t elba;
 	uint32_t len, elen;
-	int err;
+	int err, first, ncq;
 	uint8_t buf[512];
 
+	first = (done == 0);
 	if (cfis[2] == ATA_DATA_SET_MANAGEMENT) {
 		len = (uint16_t)cfis[13] << 8 | cfis[12];
 		len *= 512;
+		ncq = 0;
 	} else { /* ATA_SEND_FPDMA_QUEUED */
 		len = (uint16_t)cfis[11] << 8 | cfis[3];
 		len *= 512;
+		ncq = 1;
 	}
 	read_prdt(p, slot, cfis, buf, sizeof(buf));
 
@@ -745,12 +798,11 @@ next:
 	aior->slot = slot;
 	aior->len = len;
 	aior->done = done;
-	aior->prdtl = 0;
+	aior->more = (len != done);
 
 	breq = &aior->io_req;
 	breq->br_offset = elba * blockif_sectsz(p->bctx);
-	breq->br_iovcnt = 1;
-	breq->br_iov[0].iov_len = elen * blockif_sectsz(p->bctx);
+	breq->br_resid = elen * blockif_sectsz(p->bctx);
 
 	/*
 	 * Mark this command in-flight.
@@ -762,6 +814,9 @@ next:
 	 */
 	TAILQ_INSERT_HEAD(&p->iobhd, aior, io_blist);
 
+	if (ncq && first)
+		ahci_write_fis_d2h_ncq(p, slot);
+
 	err = blockif_delete(p->bctx, breq);
 	assert(err == 0);
 }
@@ -903,7 +958,6 @@ handle_identify(struct ahci_port *p, int slot, uint8_t *cfis)
 		buf[88] = 0x7f;
 		if (p->xfermode & ATA_UDMA0)
 			buf[88] |= (1 << ((p->xfermode & 7) + 8));
-		buf[93] = (1 | 1 <<14);
 		buf[100] = sectors;
 		buf[101] = (sectors >> 16);
 		buf[102] = (sectors >> 32);
@@ -1242,8 +1296,7 @@ atapi_report_luns(struct ahci_port *p, int slot, uint8_t *cfis)
 }
 
 static void
-atapi_read(struct ahci_port *p, int slot, uint8_t *cfis,
-		uint32_t done, int seek)
+atapi_read(struct ahci_port *p, int slot, uint8_t *cfis, uint32_t done)
 {
 	struct ahci_ioreq *aior;
 	struct ahci_cmd_hdr *hdr;
@@ -1253,14 +1306,13 @@ atapi_read(struct ahci_port *p, int slot, uint8_t *cfis,
 	uint8_t *acmd;
 	uint64_t lba;
 	uint32_t len;
-	int i, err, iovcnt;
+	int err;
 
 	sc = p->pr_sc;
 	acmd = cfis + 0x40;
 	hdr = (struct ahci_cmd_hdr *)(p->cmd_lst + slot * AHCI_CL_SIZE);
 	prdt = (struct ahci_prdt_entry *)(cfis + 0x80);
 
-	prdt += seek;
 	lba = be32dec(acmd + 2);
 	if (acmd[0] == READ_10)
 		len = be16dec(acmd + 7);
@@ -1285,37 +1337,14 @@ atapi_read(struct ahci_port *p, int slot, uint8_t *cfis,
 	aior->done = done;
 	breq = &aior->io_req;
 	breq->br_offset = lba + done;
-	iovcnt = hdr->prdtl - seek;
-	if (iovcnt > BLOCKIF_IOV_MAX) {
-		aior->prdtl = iovcnt - BLOCKIF_IOV_MAX;
-		iovcnt = BLOCKIF_IOV_MAX;
-	} else
-		aior->prdtl = 0;
-	breq->br_iovcnt = iovcnt;
+	ahci_build_iov(p, aior, prdt, hdr->prdtl);
 
-	/*
-	 * Mark this command in-flight.
-	 */
+	/* Mark this command in-flight. */
 	p->pending |= 1 << slot;
 
-	/*
-	 * Stuff request onto busy list
-	 */
+	/* Stuff request onto busy list. */
 	TAILQ_INSERT_HEAD(&p->iobhd, aior, io_blist);
 
-	/*
-	 * Build up the iovec based on the prdt
-	 */
-	for (i = 0; i < iovcnt; i++) {
-		uint32_t dbcsz;
-
-		dbcsz = (prdt->dbc & DBCMASK) + 1;
-		breq->br_iov[i].iov_base = paddr_guest2host(ahci_ctx(sc),
-		    prdt->dba, dbcsz);
-		breq->br_iov[i].iov_len = dbcsz;
-		aior->done += dbcsz;
-		prdt++;
-	}
 	err = blockif_read(p->bctx, breq);
 	assert(err == 0);
 }
@@ -1515,7 +1544,7 @@ handle_packet_cmd(struct ahci_port *p, int slot, uint8_t *cfis)
 		break;
 	case READ_10:
 	case READ_12:
-		atapi_read(p, slot, cfis, 0, 0);
+		atapi_read(p, slot, cfis, 0);
 		break;
 	case REQUEST_SENSE:
 		atapi_request_sense(p, slot, cfis);
@@ -1543,6 +1572,7 @@ static void
 ahci_handle_cmd(struct ahci_port *p, int slot, uint8_t *cfis)
 {
 
+	p->tfd |= ATA_S_BUSY;
 	switch (cfis[2]) {
 	case ATA_ATA_IDENTIFY:
 		handle_identify(p, slot, cfis);
@@ -1614,7 +1644,7 @@ ahci_handle_cmd(struct ahci_port *p, int slot, uint8_t *cfis)
 	case ATA_WRITE_DMA48:
 	case ATA_READ_FPDMA_QUEUED:
 	case ATA_WRITE_FPDMA_QUEUED:
-		ahci_handle_dma(p, slot, cfis, 0, 0);
+		ahci_handle_rw(p, slot, cfis, 0);
 		break;
 	case ATA_FLUSHCACHE:
 	case ATA_FLUSHCACHE48:
@@ -1755,7 +1785,7 @@ ata_ioreq_cb(struct blockif_req *br, int err)
 	struct pci_ahci_softc *sc;
 	uint32_t tfd;
 	uint8_t *cfis;
-	int pending, slot, ncq, dsm;
+	int slot, ncq, dsm;
 
 	DPRINTF("%s %d\n", __func__, err);
 
@@ -1764,7 +1794,6 @@ ata_ioreq_cb(struct blockif_req *br, int err)
 	p = aior->io_pr;
 	cfis = aior->cfis;
 	slot = aior->slot;
-	pending = aior->prdtl;
 	sc = p->pr_sc;
 	hdr = (struct ahci_cmd_hdr *)(p->cmd_lst + slot * AHCI_CL_SIZE);
 
@@ -1792,25 +1821,18 @@ ata_ioreq_cb(struct blockif_req *br, int err)
 	if (!err)
 		hdr->prdbc = aior->done;
 
-	if (dsm) {
-		if (aior->done != aior->len && !err) {
+	if (!err && aior->more) {
+		if (dsm)
 			ahci_handle_dsm_trim(p, slot, cfis, aior->done);
-			goto out;
-		}
-	} else {
-		if (pending && !err) {
-			ahci_handle_dma(p, slot, cfis, aior->done,
-			    hdr->prdtl - pending);
-			goto out;
-		}
+		else 
+			ahci_handle_rw(p, slot, cfis, aior->done);
+		goto out;
 	}
 
-	if (!err && aior->done == aior->len) {
+	if (!err)
 		tfd = ATA_S_READY | ATA_S_DSC;
-	} else {
+	else
 		tfd = (ATA_E_ABORT << 8) | ATA_S_READY | ATA_S_ERROR;
-	}
-
 	if (ncq)
 		ahci_write_fis_sdb(p, slot, cfis, tfd);
 	else
@@ -1836,7 +1858,7 @@ atapi_ioreq_cb(struct blockif_req *br, int err)
 	struct pci_ahci_softc *sc;
 	uint8_t *cfis;
 	uint32_t tfd;
-	int pending, slot;
+	int slot;
 
 	DPRINTF("%s %d\n", __func__, err);
 
@@ -1844,7 +1866,6 @@ atapi_ioreq_cb(struct blockif_req *br, int err)
 	p = aior->io_pr;
 	cfis = aior->cfis;
 	slot = aior->slot;
-	pending = aior->prdtl;
 	sc = p->pr_sc;
 	hdr = (struct ahci_cmd_hdr *)(p->cmd_lst + aior->slot * AHCI_CL_SIZE);
 
@@ -1863,19 +1884,18 @@ atapi_ioreq_cb(struct blockif_req *br, int err)
 	if (!err)
 		hdr->prdbc = aior->done;
 
-	if (pending && !err) {
-		atapi_read(p, slot, cfis, aior->done, hdr->prdtl - pending);
+	if (!err && aior->more) {
+		atapi_read(p, slot, cfis, aior->done);
 		goto out;
 	}
 
-	if (!err && aior->done == aior->len) {
+	if (!err) {
 		tfd = ATA_S_READY | ATA_S_DSC;
 	} else {
 		p->sense_key = ATA_SENSE_ILLEGAL_REQUEST;
 		p->asc = 0x21;
 		tfd = (p->sense_key << 12) | ATA_S_READY | ATA_S_ERROR;
 	}
-
 	cfis[4] = (cfis[4] & ~7) | ATA_I_CMD | ATA_I_IN;
 	ahci_write_fis_d2h(p, slot, cfis, tfd);
 
@@ -1949,8 +1969,15 @@ pci_ahci_port_write(struct pci_ahci_softc *sc, uint64_t offset, uint64_t value)
 		break;
 	case AHCI_P_CMD:
 	{
-		p->cmd = value;
-		
+		p->cmd &= ~(AHCI_P_CMD_ST | AHCI_P_CMD_SUD | AHCI_P_CMD_POD |
+		    AHCI_P_CMD_CLO | AHCI_P_CMD_FRE | AHCI_P_CMD_APSTE |
+		    AHCI_P_CMD_ATAPI | AHCI_P_CMD_DLAE | AHCI_P_CMD_ALPE |
+		    AHCI_P_CMD_ASP | AHCI_P_CMD_ICC_MASK);
+		p->cmd |= (AHCI_P_CMD_ST | AHCI_P_CMD_SUD | AHCI_P_CMD_POD |
+		    AHCI_P_CMD_CLO | AHCI_P_CMD_FRE | AHCI_P_CMD_APSTE |
+		    AHCI_P_CMD_ATAPI | AHCI_P_CMD_DLAE | AHCI_P_CMD_ALPE |
+		    AHCI_P_CMD_ASP | AHCI_P_CMD_ICC_MASK) & value;
+
 		if (!(value & AHCI_P_CMD_ST)) {
 			ahci_port_stop(p);
 		} else {
@@ -1978,6 +2005,10 @@ pci_ahci_port_write(struct pci_ahci_softc *sc, uint64_t offset, uint64_t value)
 			p->cmd &= ~AHCI_P_CMD_CLO;
 		}
 
+		if (value & AHCI_P_CMD_ICC_MASK) {
+			p->cmd &= ~AHCI_P_CMD_ICC_MASK;
+		}
+
 		ahci_handle_port(p);
 		break;
 	}
diff --git a/usr.sbin/bhyve/pci_emul.c b/usr.sbin/bhyve/pci_emul.c
index 6b906ed..03ff0c0 100644
--- a/usr.sbin/bhyve/pci_emul.c
+++ b/usr.sbin/bhyve/pci_emul.c
@@ -59,17 +59,6 @@ __FBSDID("$FreeBSD$");
 
 #define CONF1_ENABLE	   0x80000000ul
 
-#define	CFGWRITE(pi,off,val,b)						\
-do {									\
-	if ((b) == 1) {							\
-		pci_set_cfgdata8((pi),(off),(val));			\
-	} else if ((b) == 2) {						\
-		pci_set_cfgdata16((pi),(off),(val));			\
-	} else {							\
-		pci_set_cfgdata32((pi),(off),(val));			\
-	}								\
-} while (0)
-
 #define	MAXBUSES	(PCI_BUSMAX + 1)
 #define MAXSLOTS	(PCI_SLOTMAX + 1)
 #define	MAXFUNCS	(PCI_FUNCMAX + 1)
@@ -124,6 +113,30 @@ static void pci_lintr_update(struct pci_devinst *pi);
 static void pci_cfgrw(struct vmctx *ctx, int vcpu, int in, int bus, int slot,
     int func, int coff, int bytes, uint32_t *val);
 
+static __inline void
+CFGWRITE(struct pci_devinst *pi, int coff, uint32_t val, int bytes)
+{
+
+	if (bytes == 1)
+		pci_set_cfgdata8(pi, coff, val);
+	else if (bytes == 2)
+		pci_set_cfgdata16(pi, coff, val);
+	else
+		pci_set_cfgdata32(pi, coff, val);
+}
+
+static __inline uint32_t
+CFGREAD(struct pci_devinst *pi, int coff, int bytes)
+{
+
+	if (bytes == 1)
+		return (pci_get_cfgdata8(pi, coff));
+	else if (bytes == 2)
+		return (pci_get_cfgdata16(pi, coff));
+	else
+		return (pci_get_cfgdata32(pi, coff));
+}
+
 /*
  * I/O access
  */
@@ -1653,27 +1666,31 @@ pci_emul_hdrtype_fixup(int bus, int slot, int off, int bytes, uint32_t *rv)
 	}
 }
 
-static uint32_t
-bits_changed(uint32_t old, uint32_t new, uint32_t mask)
-{
-
-	return ((old ^ new) & mask);
-}
-
 static void
-pci_emul_cmdwrite(struct pci_devinst *pi, uint32_t new, int bytes)
+pci_emul_cmdsts_write(struct pci_devinst *pi, int coff, uint32_t new, int bytes)
 {
-	int i;
-	uint16_t old;
+	int i, rshift;
+	uint32_t cmd, cmd2, changed, old, readonly;
+
+	cmd = pci_get_cfgdata16(pi, PCIR_COMMAND);	/* stash old value */
 
 	/*
-	 * The command register is at an offset of 4 bytes and thus the
-	 * guest could write 1, 2 or 4 bytes starting at this offset.
+	 * From PCI Local Bus Specification 3.0 sections 6.2.2 and 6.2.3.
+	 *
+	 * XXX Bits 8, 11, 12, 13, 14 and 15 in the status register are
+	 * 'write 1 to clear'. However these bits are not set to '1' by
+	 * any device emulation so it is simpler to treat them as readonly.
 	 */
+	rshift = (coff & 0x3) * 8;
+	readonly = 0xFFFFF880 >> rshift;
 
-	old = pci_get_cfgdata16(pi, PCIR_COMMAND);	/* stash old value */
-	CFGWRITE(pi, PCIR_COMMAND, new, bytes);		/* update config */
-	new = pci_get_cfgdata16(pi, PCIR_COMMAND);	/* get updated value */
+	old = CFGREAD(pi, coff, bytes);
+	new &= ~readonly;
+	new |= (old & readonly);
+	CFGWRITE(pi, coff, new, bytes);			/* update config */
+
+	cmd2 = pci_get_cfgdata16(pi, PCIR_COMMAND);	/* get updated value */
+	changed = cmd ^ cmd2;
 
 	/*
 	 * If the MMIO or I/O address space decoding has changed then
@@ -1686,7 +1703,7 @@ pci_emul_cmdwrite(struct pci_devinst *pi, uint32_t new, int bytes)
 				break;
 			case PCIBAR_IO:
 				/* I/O address space decoding changed? */
-				if (bits_changed(old, new, PCIM_CMD_PORTEN)) {
+				if (changed & PCIM_CMD_PORTEN) {
 					if (porten(pi))
 						register_bar(pi, i);
 					else
@@ -1696,7 +1713,7 @@ pci_emul_cmdwrite(struct pci_devinst *pi, uint32_t new, int bytes)
 			case PCIBAR_MEM32:
 			case PCIBAR_MEM64:
 				/* MMIO address space decoding changed? */
-				if (bits_changed(old, new, PCIM_CMD_MEMEN)) {
+				if (changed & PCIM_CMD_MEMEN) {
 					if (memen(pi))
 						register_bar(pi, i);
 					else
@@ -1776,14 +1793,8 @@ pci_cfgrw(struct vmctx *ctx, int vcpu, int in, int bus, int slot, int func,
 			needcfg = 1;
 		}
 
-		if (needcfg) {
-			if (bytes == 1)
-				*eax = pci_get_cfgdata8(pi, coff);
-			else if (bytes == 2)
-				*eax = pci_get_cfgdata16(pi, coff);
-			else
-				*eax = pci_get_cfgdata32(pi, coff);
-		}
+		if (needcfg)
+			*eax = CFGREAD(pi, coff, bytes);
 
 		pci_emul_hdrtype_fixup(bus, slot, coff, bytes, eax);
 	} else {
@@ -1853,8 +1864,8 @@ pci_cfgrw(struct vmctx *ctx, int vcpu, int in, int bus, int slot, int func,
 
 		} else if (pci_emul_iscap(pi, coff)) {
 			pci_emul_capwrite(pi, coff, bytes, *eax);
-		} else if (coff == PCIR_COMMAND) {
-			pci_emul_cmdwrite(pi, *eax, bytes);
+		} else if (coff >= PCIR_COMMAND && coff < PCIR_REVID) {
+			pci_emul_cmdsts_write(pi, coff, *eax, bytes);
 		} else {
 			CFGWRITE(pi, coff, *eax, bytes);
 		}
@@ -1927,7 +1938,7 @@ INOUT_PORT(pci_cfgdata, CONF1_DATA_PORT+3, IOPORT_F_INOUT, pci_emul_cfgdata);
 #define DMEMSZ	4096
 struct pci_emul_dsoftc {
 	uint8_t   ioregs[DIOSZ];
-	uint8_t	  memregs[DMEMSZ];
+	uint8_t	  memregs[2][DMEMSZ];
 };
 
 #define	PCI_EMUL_MSI_MSGS	 4
@@ -1956,6 +1967,9 @@ pci_emul_dinit(struct vmctx *ctx, struct pci_devinst *pi, char *opts)
 	error = pci_emul_alloc_bar(pi, 1, PCIBAR_MEM32, DMEMSZ);
 	assert(error == 0);
 
+	error = pci_emul_alloc_bar(pi, 2, PCIBAR_MEM32, DMEMSZ);
+	assert(error == 0);
+
 	return (0);
 }
 
@@ -1995,21 +2009,23 @@ pci_emul_diow(struct vmctx *ctx, int vcpu, struct pci_devinst *pi, int baridx,
 		}
 	}
 
-	if (baridx == 1) {
+	if (baridx == 1 || baridx == 2) {
 		if (offset + size > DMEMSZ) {
 			printf("diow: memw too large, offset %ld size %d\n",
 			       offset, size);
 			return;
 		}
 
+		i = baridx - 1;		/* 'memregs' index */
+
 		if (size == 1) {
-			sc->memregs[offset] = value;
+			sc->memregs[i][offset] = value;
 		} else if (size == 2) {
-			*(uint16_t *)&sc->memregs[offset] = value;
+			*(uint16_t *)&sc->memregs[i][offset] = value;
 		} else if (size == 4) {
-			*(uint32_t *)&sc->memregs[offset] = value;
+			*(uint32_t *)&sc->memregs[i][offset] = value;
 		} else if (size == 8) {
-			*(uint64_t *)&sc->memregs[offset] = value;
+			*(uint64_t *)&sc->memregs[i][offset] = value;
 		} else {
 			printf("diow: memw unknown size %d\n", size);
 		}
@@ -2019,7 +2035,7 @@ pci_emul_diow(struct vmctx *ctx, int vcpu, struct pci_devinst *pi, int baridx,
 		 */
 	}
 
-	if (baridx > 1) {
+	if (baridx > 2) {
 		printf("diow: unknown bar idx %d\n", baridx);
 	}
 }
@@ -2030,6 +2046,7 @@ pci_emul_dior(struct vmctx *ctx, int vcpu, struct pci_devinst *pi, int baridx,
 {
 	struct pci_emul_dsoftc *sc = pi->pi_arg;
 	uint32_t value;
+	int i;
 
 	if (baridx == 0) {
 		if (offset + size > DIOSZ) {
@@ -2048,29 +2065,31 @@ pci_emul_dior(struct vmctx *ctx, int vcpu, struct pci_devinst *pi, int baridx,
 			printf("dior: ior unknown size %d\n", size);
 		}
 	}
-	
-	if (baridx == 1) {
+
+	if (baridx == 1 || baridx == 2) {
 		if (offset + size > DMEMSZ) {
 			printf("dior: memr too large, offset %ld size %d\n",
 			       offset, size);
 			return (0);
 		}
-	
+		
+		i = baridx - 1;		/* 'memregs' index */
+
 		if (size == 1) {
-			value = sc->memregs[offset];
+			value = sc->memregs[i][offset];
 		} else if (size == 2) {
-			value = *(uint16_t *) &sc->memregs[offset];
+			value = *(uint16_t *) &sc->memregs[i][offset];
 		} else if (size == 4) {
-			value = *(uint32_t *) &sc->memregs[offset];
+			value = *(uint32_t *) &sc->memregs[i][offset];
 		} else if (size == 8) {
-			value = *(uint64_t *) &sc->memregs[offset];
+			value = *(uint64_t *) &sc->memregs[i][offset];
 		} else {
 			printf("dior: ior unknown size %d\n", size);
 		}
 	}
 
 
-	if (baridx > 1) {
+	if (baridx > 2) {
 		printf("dior: unknown bar idx %d\n", baridx);
 		return (0);
 	}
diff --git a/usr.sbin/bhyve/pci_irq.c b/usr.sbin/bhyve/pci_irq.c
index 20e033f..f22b15c 100644
--- a/usr.sbin/bhyve/pci_irq.c
+++ b/usr.sbin/bhyve/pci_irq.c
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 2014 Advanced Computing Technologies LLC
+ * Copyright (c) 2014 Hudson River Trading LLC
  * Written by: John H. Baldwin <jhb@FreeBSD.org>
  * All rights reserved.
  *
diff --git a/usr.sbin/bhyve/pci_irq.h b/usr.sbin/bhyve/pci_irq.h
index 9d331a5..24f9c99 100644
--- a/usr.sbin/bhyve/pci_irq.h
+++ b/usr.sbin/bhyve/pci_irq.h
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 2014 Advanced Computing Technologies LLC
+ * Copyright (c) 2014 Hudson River Trading LLC
  * Written by: John H. Baldwin <jhb@FreeBSD.org>
  * All rights reserved.
  *
diff --git a/usr.sbin/bhyve/pci_virtio_block.c b/usr.sbin/bhyve/pci_virtio_block.c
index 967b528..35daa1f 100644
--- a/usr.sbin/bhyve/pci_virtio_block.c
+++ b/usr.sbin/bhyve/pci_virtio_block.c
@@ -198,7 +198,7 @@ pci_vtblk_proc(struct pci_vtblk_softc *sc, struct vqueue_info *vq)
 	struct pci_vtblk_ioreq *io;
 	int i, n;
 	int err;
-	int iolen;
+	ssize_t iolen;
 	int writeop, type;
 	off_t offset;
 	struct iovec iov[BLOCKIF_IOV_MAX + 2];
@@ -246,8 +246,9 @@ pci_vtblk_proc(struct pci_vtblk_softc *sc, struct vqueue_info *vq)
 		assert(((flags[i] & VRING_DESC_F_WRITE) == 0) == writeop);
 		iolen += iov[i].iov_len;
 	}
+	io->io_req.br_resid = iolen;
 
-	DPRINTF(("virtio-block: %s op, %d bytes, %d segs, offset %ld\n\r", 
+	DPRINTF(("virtio-block: %s op, %zd bytes, %d segs, offset %ld\n\r", 
 		 writeop ? "write" : "read/ident", iolen, i - 1, offset));
 
 	switch (type) {
diff --git a/usr.sbin/bhyve/pci_virtio_net.c b/usr.sbin/bhyve/pci_virtio_net.c
index 457a405..7227488 100644
--- a/usr.sbin/bhyve/pci_virtio_net.c
+++ b/usr.sbin/bhyve/pci_virtio_net.c
@@ -393,6 +393,7 @@ pci_vtnet_ping_rxq(void *vsc, struct vqueue_info *vq)
 	 */
 	if (sc->vsc_rx_ready == 0) {
 		sc->vsc_rx_ready = 1;
+		vq->vq_used->vu_flags |= VRING_USED_F_NO_NOTIFY;
 	}
 }
 
@@ -438,6 +439,7 @@ pci_vtnet_ping_txq(void *vsc, struct vqueue_info *vq)
 
 	/* Signal the tx thread for processing */
 	pthread_mutex_lock(&sc->tx_mtx);
+	vq->vq_used->vu_flags |= VRING_USED_F_NO_NOTIFY;
 	if (sc->tx_in_progress == 0)
 		pthread_cond_signal(&sc->tx_cond);
 	pthread_mutex_unlock(&sc->tx_mtx);
@@ -466,6 +468,7 @@ pci_vtnet_tx_thread(void *param)
 	for (;;) {
 		/* note - tx mutex is locked here */
 		do {
+			vq->vq_used->vu_flags &= ~VRING_USED_F_NO_NOTIFY;
 			if (sc->resetting)
 				have_work = 0;
 			else
@@ -478,6 +481,7 @@ pci_vtnet_tx_thread(void *param)
 				assert(error == 0);
 			}
 		} while (!have_work);
+		vq->vq_used->vu_flags |= VRING_USED_F_NO_NOTIFY;
 		sc->tx_in_progress = 1;
 		pthread_mutex_unlock(&sc->tx_mtx);
 
@@ -640,8 +644,8 @@ pci_vtnet_init(struct vmctx *ctx, struct pci_devinst *pi, char *opts)
 	pci_set_cfgdata8(pi, PCIR_CLASS, PCIC_NETWORK);
 	pci_set_cfgdata16(pi, PCIR_SUBDEV_0, VIRTIO_TYPE_NET);
 
-	/* link always up */
-	sc->vsc_config.status = 1;
+	/* Link is up if we managed to open tap device. */
+	sc->vsc_config.status = (opts == NULL || sc->vsc_tapfd >= 0);
 	
 	/* use BAR 1 to map MSI-X table and PBA, if we're using MSI-X */
 	if (vi_intr_init(&sc->vsc_vs, 1, fbsdrun_virtio_msix()))
diff --git a/usr.sbin/bhyve/pm.c b/usr.sbin/bhyve/pm.c
index f5a2d43..f7c1c23 100644
--- a/usr.sbin/bhyve/pm.c
+++ b/usr.sbin/bhyve/pm.c
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 2013 Advanced Computing Technologies LLC
+ * Copyright (c) 2013 Hudson River Trading LLC
  * Written by: John H. Baldwin <jhb@FreeBSD.org>
  * All rights reserved.
  *
diff --git a/usr.sbin/bhyvectl/Makefile b/usr.sbin/bhyvectl/Makefile
index c48ca6e..5c088a3 100644
--- a/usr.sbin/bhyvectl/Makefile
+++ b/usr.sbin/bhyvectl/Makefile
@@ -8,7 +8,7 @@ PACKAGE=	bhyve
 
 MAN=
 
-LIBADD=	vmmapi util
+LIBADD=	vmmapi
 
 WARNS?=	3
 
diff --git a/usr.sbin/bhyvectl/bhyvectl.c b/usr.sbin/bhyvectl/bhyvectl.c
index e2b514d..223ee25 100644
--- a/usr.sbin/bhyvectl/bhyvectl.c
+++ b/usr.sbin/bhyvectl/bhyvectl.c
@@ -640,9 +640,9 @@ get_all_registers(struct vmctx *ctx, int vcpu)
 	uint64_t cr0, cr3, cr4, dr7, rsp, rip, rflags, efer;
 	uint64_t rax, rbx, rcx, rdx, rsi, rdi, rbp;
 	uint64_t r8, r9, r10, r11, r12, r13, r14, r15;
-	int error;
+	int error = 0;
 
-	if (get_efer || get_all) {
+	if (!error && (get_efer || get_all)) {
 		error = vm_get_register(ctx, vcpu, VM_REG_GUEST_EFER, &efer);
 		if (error == 0)
 			printf("efer[%d]\t\t0x%016lx\n", vcpu, efer);
@@ -787,10 +787,10 @@ get_all_registers(struct vmctx *ctx, int vcpu)
 static int
 get_all_segments(struct vmctx *ctx, int vcpu)
 {
-	int error;
 	uint64_t cs, ds, es, fs, gs, ss, tr, ldtr;
+	int error = 0;
 
-	if (get_desc_ds || get_all) {
+	if (!error && (get_desc_ds || get_all)) {
 		error = vm_get_desc(ctx, vcpu, VM_REG_GUEST_DS,
 				   &desc_base, &desc_limit, &desc_access);
 		if (error == 0) {
@@ -935,9 +935,9 @@ static int
 get_misc_vmcs(struct vmctx *ctx, int vcpu)
 {
 	uint64_t ctl, cr0, cr3, cr4, rsp, rip, pat, addr, u64;
-	int error;
-	
-	if (get_cr0_mask || get_all) {
+	int error = 0;
+
+	if (!error && (get_cr0_mask || get_all)) {
 		uint64_t cr0mask;
 		error = vm_get_vmcs_field(ctx, vcpu, VMCS_CR0_MASK, &cr0mask);
 		if (error == 0)
@@ -1161,9 +1161,9 @@ static int
 get_misc_vmcb(struct vmctx *ctx, int vcpu)
 {
 	uint64_t ctl, addr;
-	int error;
+	int error = 0;
 
-	if (get_vmcb_intercept || get_all) {
+	if (!error && (get_vmcb_intercept || get_all)) {
 		error = vm_get_vmcb_field(ctx, vcpu, VMCB_OFF_CR_INTERCEPT, 4,
 		    &ctl);
 		if (error == 0)
diff --git a/usr.sbin/bhyveload/Makefile b/usr.sbin/bhyveload/Makefile
index 17c6c8d..5fa692d 100644
--- a/usr.sbin/bhyveload/Makefile
+++ b/usr.sbin/bhyveload/Makefile
@@ -5,7 +5,7 @@ SRCS=	bhyveload.c
 MAN=	bhyveload.8
 PACKAGE=	bhyve
 
-LIBADD=	vmmapi util
+LIBADD=	vmmapi
 
 WARNS?=	3
 
diff --git a/usr.sbin/bluetooth/Makefile b/usr.sbin/bluetooth/Makefile
index 594b440..1737107 100644
--- a/usr.sbin/bluetooth/Makefile
+++ b/usr.sbin/bluetooth/Makefile
@@ -1,12 +1,10 @@
 # $Id: Makefile,v 1.5 2003/09/08 02:28:35 max Exp $
 # $FreeBSD$
 
+.include <src.opts.mk>
+
 SUBDIR= \
-	ath3kfw \
-	bcmfw \
 	bt3cfw \
-	bthidcontrol \
-	bthidd \
 	btpand \
 	hccontrol \
 	hcsecd \
@@ -17,5 +15,12 @@ SUBDIR= \
 	sdpcontrol \
 	sdpd
 
+.if ${MK_USB} != "no"
+SUBDIR+=	ath3kfw
+SUBDIR+=	bcmfw
+SUBDIR+=	bthidcontrol
+SUBDIR+=	bthidd
+.endif
+
 .include <bsd.subdir.mk>
 
diff --git a/usr.sbin/bluetooth/bthidcontrol/bthidcontrol.c b/usr.sbin/bluetooth/bthidcontrol/bthidcontrol.c
index 900bda5..0f795dd 100644
--- a/usr.sbin/bluetooth/bthidcontrol/bthidcontrol.c
+++ b/usr.sbin/bluetooth/bthidcontrol/bthidcontrol.c
@@ -31,6 +31,7 @@
 
 #include <sys/queue.h>
 #include <assert.h>
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <err.h>
 #include <errno.h>
diff --git a/usr.sbin/bluetooth/bthidcontrol/hid.c b/usr.sbin/bluetooth/bthidcontrol/hid.c
index 9fb6220..e43ef6a 100644
--- a/usr.sbin/bluetooth/bthidcontrol/hid.c
+++ b/usr.sbin/bluetooth/bthidcontrol/hid.c
@@ -30,6 +30,7 @@
  */
 
 #include <sys/queue.h>
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <dev/usb/usb.h>
 #include <dev/usb/usbhid.h>
diff --git a/usr.sbin/bluetooth/bthidcontrol/sdp.c b/usr.sbin/bluetooth/bthidcontrol/sdp.c
index a0b4534..3beabc1 100644
--- a/usr.sbin/bluetooth/bthidcontrol/sdp.c
+++ b/usr.sbin/bluetooth/bthidcontrol/sdp.c
@@ -30,6 +30,7 @@
  */
 
 #include <sys/queue.h>
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <dev/usb/usb.h>
 #include <dev/usb/usbhid.h>
diff --git a/usr.sbin/bluetooth/bthidd/bthidd.c b/usr.sbin/bluetooth/bthidd/bthidd.c
index b93fd3d..7e988fc 100644
--- a/usr.sbin/bluetooth/bthidd/bthidd.c
+++ b/usr.sbin/bluetooth/bthidd/bthidd.c
@@ -34,6 +34,7 @@
 #include <sys/time.h>
 #include <sys/queue.h>
 #include <assert.h>
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <err.h>
 #include <errno.h>
diff --git a/usr.sbin/bluetooth/bthidd/client.c b/usr.sbin/bluetooth/bthidd/client.c
index 59f0d19..5f01133 100644
--- a/usr.sbin/bluetooth/bthidd/client.c
+++ b/usr.sbin/bluetooth/bthidd/client.c
@@ -33,6 +33,7 @@
 
 #include <sys/queue.h>
 #include <assert.h>
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <errno.h>
 #include <fcntl.h>
@@ -236,7 +237,9 @@ client_socket(bdaddr_p bdaddr, uint16_t psm)
 	l2addr.l2cap_family = AF_BLUETOOTH;
 	memset(&l2addr.l2cap_bdaddr, 0, sizeof(l2addr.l2cap_bdaddr));
 	l2addr.l2cap_psm = 0;
-
+	l2addr.l2cap_bdaddr_type = BDADDR_BREDR;
+	l2addr.l2cap_cid = 0;
+	
 	if (bind(s, (struct sockaddr *) &l2addr, sizeof(l2addr)) < 0) {
 		close(s);
 		return (-1);
diff --git a/usr.sbin/bluetooth/bthidd/hid.c b/usr.sbin/bluetooth/bthidd/hid.c
index c68865b..69a6fdc 100644
--- a/usr.sbin/bluetooth/bthidd/hid.c
+++ b/usr.sbin/bluetooth/bthidd/hid.c
@@ -35,6 +35,7 @@
 #include <sys/mouse.h>
 #include <sys/queue.h>
 #include <assert.h>
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <dev/usb/usb.h>
 #include <dev/usb/usbhid.h>
@@ -48,12 +49,6 @@
 #include "bthidd.h"
 #include "kbd.h"
 
-#undef	min
-#define	min(x, y)	(((x) < (y))? (x) : (y))
-
-#undef	ASIZE
-#define	ASIZE(a)	(sizeof(a)/sizeof(a[0]))
-
 /*
  * Process data from control channel
  */
@@ -165,9 +160,21 @@ hid_interrupt(bthid_session_p s, uint8_t *data, int32_t len)
 			continue;
 
 		page = HID_PAGE(h.usage);
-		usage = HID_USAGE(h.usage);
 		val = hid_get_data(data, &h);
 
+		/*
+		 * When the input field is an array and the usage is specified
+		 * with a range instead of an ID, we have to derive the actual
+		 * usage by using the item value as an index in the usage range
+		 * list.
+		 */
+		if ((h.flags & HIO_VARIABLE)) {
+			usage = HID_USAGE(h.usage);
+		} else {
+			const uint32_t usage_offset = val - h.logical_minimum;
+			usage = HID_USAGE(h.usage_minimum + usage_offset);
+		}
+
 		switch (page) {
 		case HUP_GENERIC_DESKTOP:
 			switch (usage) {
diff --git a/usr.sbin/bluetooth/bthidd/kbd.c b/usr.sbin/bluetooth/bthidd/kbd.c
index 20b6278..e570b80 100644
--- a/usr.sbin/bluetooth/bthidd/kbd.c
+++ b/usr.sbin/bluetooth/bthidd/kbd.c
@@ -37,6 +37,7 @@
 #include <sys/queue.h>
 #include <sys/wait.h>
 #include <assert.h>
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <dev/usb/usb.h>
 #include <dev/usb/usbhid.h>
diff --git a/usr.sbin/bluetooth/bthidd/lexer.l b/usr.sbin/bluetooth/bthidd/lexer.l
index b9f62a1..6d913ee 100644
--- a/usr.sbin/bluetooth/bthidd/lexer.l
+++ b/usr.sbin/bluetooth/bthidd/lexer.l
@@ -31,7 +31,7 @@
  * $Id: lexer.l,v 1.3 2006/09/07 21:06:53 max Exp $
  * $FreeBSD$
  */
-
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <stdlib.h>
 #include "parser.h"
diff --git a/usr.sbin/bluetooth/bthidd/parser.y b/usr.sbin/bluetooth/bthidd/parser.y
index 50468f4..dbb2763 100644
--- a/usr.sbin/bluetooth/bthidd/parser.y
+++ b/usr.sbin/bluetooth/bthidd/parser.y
@@ -33,6 +33,7 @@
  */
 
 #include <sys/queue.h>
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <dev/usb/usb.h>
 #include <dev/usb/usbhid.h>
diff --git a/usr.sbin/bluetooth/bthidd/server.c b/usr.sbin/bluetooth/bthidd/server.c
index d76bd62..26aeb4a 100644
--- a/usr.sbin/bluetooth/bthidd/server.c
+++ b/usr.sbin/bluetooth/bthidd/server.c
@@ -33,6 +33,7 @@
 
 #include <sys/queue.h>
 #include <assert.h>
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <dev/vkbd/vkbd_var.h>
 #include <errno.h>
@@ -90,7 +91,9 @@ server_init(bthid_server_p srv)
 	l2addr.l2cap_family = AF_BLUETOOTH;
 	memcpy(&l2addr.l2cap_bdaddr, &srv->bdaddr, sizeof(l2addr.l2cap_bdaddr));
 	l2addr.l2cap_psm = htole16(0x11);
-
+	l2addr.l2cap_bdaddr_type = BDADDR_BREDR;
+	l2addr.l2cap_cid = 0;
+	
 	if (bind(srv->ctrl, (struct sockaddr *) &l2addr, sizeof(l2addr)) < 0) {
 		syslog(LOG_ERR, "Could not bind control L2CAP socket. " \
 			"%s (%d)", strerror(errno), errno);
diff --git a/usr.sbin/bluetooth/bthidd/session.c b/usr.sbin/bluetooth/bthidd/session.c
index b9f331b..260cb86 100644
--- a/usr.sbin/bluetooth/bthidd/session.c
+++ b/usr.sbin/bluetooth/bthidd/session.c
@@ -33,6 +33,7 @@
 
 #include <sys/queue.h>
 #include <assert.h>
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <errno.h>
 #include <fcntl.h>
diff --git a/usr.sbin/bluetooth/btpand/bnep.c b/usr.sbin/bluetooth/btpand/bnep.c
index 200a723..4065b1b 100644
--- a/usr.sbin/bluetooth/btpand/bnep.c
+++ b/usr.sbin/bluetooth/btpand/bnep.c
@@ -31,6 +31,7 @@
 __RCSID("$NetBSD: bnep.c,v 1.1 2008/08/17 13:20:57 plunky Exp $");
 
 #include <sys/uio.h>
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <sdp.h>
 #include <stdarg.h>
diff --git a/usr.sbin/bluetooth/btpand/btpand.c b/usr.sbin/bluetooth/btpand/btpand.c
index 9387444..243fcf5 100644
--- a/usr.sbin/bluetooth/btpand/btpand.c
+++ b/usr.sbin/bluetooth/btpand/btpand.c
@@ -33,6 +33,7 @@ __RCSID("$NetBSD: btpand.c,v 1.1 2008/08/17 13:20:57 plunky Exp $");
 
 #include <sys/wait.h>
 
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <err.h>
 #include <fcntl.h>
diff --git a/usr.sbin/bluetooth/btpand/channel.c b/usr.sbin/bluetooth/btpand/channel.c
index b4eb4ab..32f2487 100644
--- a/usr.sbin/bluetooth/btpand/channel.c
+++ b/usr.sbin/bluetooth/btpand/channel.c
@@ -35,7 +35,7 @@ __RCSID("$NetBSD: channel.c,v 1.1 2008/08/17 13:20:57 plunky Exp $");
 
 #include <libutil.h>
 #include <unistd.h>
-
+#define L2CAP_SOCKET_CHECKED
 #include "btpand.h"
 
 static struct chlist	channel_list;
diff --git a/usr.sbin/bluetooth/btpand/client.c b/usr.sbin/bluetooth/btpand/client.c
index 2cc9089..f88dc6e 100644
--- a/usr.sbin/bluetooth/btpand/client.c
+++ b/usr.sbin/bluetooth/btpand/client.c
@@ -30,6 +30,7 @@
 #include <sys/cdefs.h>
 __RCSID("$NetBSD: client.c,v 1.2 2008/12/06 20:01:14 plunky Exp $");
 
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <errno.h>
 #include <sdp.h>
@@ -65,6 +66,9 @@ client_init(void)
 	memset(&sa, 0, sizeof(sa));
 	sa.l2cap_family = AF_BLUETOOTH;
 	sa.l2cap_len = sizeof(sa);
+	sa.l2cap_bdaddr_type = BDADDR_BREDR;
+	sa.l2cap_cid = 0;
+	 
 	bdaddr_copy(&sa.l2cap_bdaddr, &local_bdaddr);
 	if (bind(fd, (struct sockaddr *)&sa, sizeof(sa)) == -1) {
 		log_err("Could not bind client socket: %m");
diff --git a/usr.sbin/bluetooth/btpand/event.c b/usr.sbin/bluetooth/btpand/event.c
index 159f90c..ac51f57 100644
--- a/usr.sbin/bluetooth/btpand/event.c
+++ b/usr.sbin/bluetooth/btpand/event.c
@@ -45,6 +45,7 @@
 #include <syslog.h>
 
 #include "event.h"
+#define L2CAP_SOCKET_CHECKED
 #include "btpand.h"
 
 #define		__event_link(ev) \
diff --git a/usr.sbin/bluetooth/btpand/packet.c b/usr.sbin/bluetooth/btpand/packet.c
index e42e5c5..21a563c 100644
--- a/usr.sbin/bluetooth/btpand/packet.c
+++ b/usr.sbin/bluetooth/btpand/packet.c
@@ -30,6 +30,7 @@
 #include <sys/cdefs.h>
 __RCSID("$NetBSD: packet.c,v 1.1 2008/08/17 13:20:57 plunky Exp $");
 
+#define L2CAP_SOCKET_CHECKED
 #include "btpand.h"
 
 packet_t *
diff --git a/usr.sbin/bluetooth/btpand/sdp.c b/usr.sbin/bluetooth/btpand/sdp.c
index e5aec1c..3cad3f8 100644
--- a/usr.sbin/bluetooth/btpand/sdp.c
+++ b/usr.sbin/bluetooth/btpand/sdp.c
@@ -32,6 +32,7 @@ __RCSID("$NetBSD: sdp.c,v 1.2 2008/12/06 20:01:14 plunky Exp $");
 
 #include <string.h>
 
+#define L2CAP_SOCKET_CHECKED
 #include "sdp.h"
 
 /*
diff --git a/usr.sbin/bluetooth/btpand/server.c b/usr.sbin/bluetooth/btpand/server.c
index b24d416..b72b032 100644
--- a/usr.sbin/bluetooth/btpand/server.c
+++ b/usr.sbin/bluetooth/btpand/server.c
@@ -32,6 +32,7 @@ __RCSID("$NetBSD: server.c,v 1.2 2009/01/24 17:29:28 plunky Exp $");
 
 #include <sys/ioctl.h>
 
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <inttypes.h>
 #include <errno.h>
@@ -103,6 +104,9 @@ server_open(void)
 	sa.l2cap_family = AF_BLUETOOTH;
 	sa.l2cap_len = sizeof(sa);
 	sa.l2cap_psm = htole16(l2cap_psm);
+	sa.l2cap_bdaddr_type = BDADDR_BREDR;
+	sa.l2cap_cid = 0;
+	
 	bdaddr_copy(&sa.l2cap_bdaddr, &local_bdaddr);
 	if (bind(server_fd, (struct sockaddr *)&sa, sizeof(sa)) == -1) {
 		log_err("Could not bind server socket: %m");
diff --git a/usr.sbin/bluetooth/btpand/tap.c b/usr.sbin/bluetooth/btpand/tap.c
index c965633..644bf02 100644
--- a/usr.sbin/bluetooth/btpand/tap.c
+++ b/usr.sbin/bluetooth/btpand/tap.c
@@ -43,6 +43,7 @@ __RCSID("$NetBSD: tap.c,v 1.1 2008/08/17 13:20:57 plunky Exp $");
 #include <stdio.h>
 #include <unistd.h>
 
+#define L2CAP_SOCKET_CHECKED
 #include "btpand.h"
 
 static bool tap_send(channel_t *, packet_t *);
diff --git a/usr.sbin/bluetooth/hccontrol/Makefile b/usr.sbin/bluetooth/hccontrol/Makefile
index 61206df..a81fda4 100644
--- a/usr.sbin/bluetooth/hccontrol/Makefile
+++ b/usr.sbin/bluetooth/hccontrol/Makefile
@@ -3,7 +3,7 @@
 
 PROG=		hccontrol
 MAN=		hccontrol.8
-SRCS=		send_recv.c link_policy.c link_control.c \
+SRCS=		send_recv.c link_policy.c link_control.c le.c\
 		host_controller_baseband.c info.c status.c node.c hccontrol.c \
 		util.c
 WARNS?=		2
diff --git a/usr.sbin/bluetooth/hccontrol/hccontrol.c b/usr.sbin/bluetooth/hccontrol/hccontrol.c
index 089869b..b72854f 100644
--- a/usr.sbin/bluetooth/hccontrol/hccontrol.c
+++ b/usr.sbin/bluetooth/hccontrol/hccontrol.c
@@ -29,6 +29,7 @@
  * $FreeBSD$
  */
 
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <sys/ioctl.h>
 #include <sys/sysctl.h>
@@ -143,6 +144,7 @@ socket_open(char const *node)
 	bit_set(filter.event_mask, NG_HCI_EVENT_READ_CLOCK_OFFSET_COMPL - 1);
 	bit_set(filter.event_mask, NG_HCI_EVENT_CON_PKT_TYPE_CHANGED - 1);
 	bit_set(filter.event_mask, NG_HCI_EVENT_ROLE_CHANGE - 1);
+	bit_set(filter.event_mask, NG_HCI_EVENT_LE -1);
 
 	if (setsockopt(s, SOL_HCI_RAW, SO_HCI_RAW_FILTER, 
 			(void * const) &filter, sizeof(filter)) < 0)
@@ -181,6 +183,7 @@ do_hci_command(char const *node, int argc, char **argv)
 			print_hci_command(host_controller_baseband_commands);
 			print_hci_command(info_commands);
 			print_hci_command(status_commands);
+			print_hci_command(le_commands);
 			print_hci_command(node_commands);
 			fprintf(stdout, "\nFor more information use " \
 				"'help command'\n");
@@ -212,6 +215,11 @@ do_hci_command(char const *node, int argc, char **argv)
 	if (c != NULL)
 		goto execute;
 
+	c = find_hci_command(cmd, le_commands);
+	if (c != NULL)
+		goto execute;
+
+	
 	c = find_hci_command(cmd, node_commands);
 	if (c == NULL) {
 		fprintf(stdout, "Unknown command: \"%s\"\n", cmd);
diff --git a/usr.sbin/bluetooth/hccontrol/hccontrol.h b/usr.sbin/bluetooth/hccontrol/hccontrol.h
index cd56ebf..c96aab0 100644
--- a/usr.sbin/bluetooth/hccontrol/hccontrol.h
+++ b/usr.sbin/bluetooth/hccontrol/hccontrol.h
@@ -53,6 +53,7 @@ extern struct hci_command	 host_controller_baseband_commands[];
 extern struct hci_command	 info_commands[];
 extern struct hci_command	 status_commands[];
 extern struct hci_command	 node_commands[];
+extern struct hci_command	 le_commands[];
  
 int                hci_request         (int, int, char const *, int, char *, int *);
 int                hci_simple_request  (int, int, char *, int *);
diff --git a/usr.sbin/bluetooth/hccontrol/host_controller_baseband.c b/usr.sbin/bluetooth/hccontrol/host_controller_baseband.c
index aae5dd1..532ca1c 100644
--- a/usr.sbin/bluetooth/hccontrol/host_controller_baseband.c
+++ b/usr.sbin/bluetooth/hccontrol/host_controller_baseband.c
@@ -29,6 +29,7 @@
  * $FreeBSD$
  */
 
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <errno.h>
 #include <stdio.h>
@@ -1487,6 +1488,78 @@ hci_write_page_scan_mode(int s, int argc, char **argv)
 	return (OK);
 } /* hci_write_page_scan_mode */
 
+static int
+hci_read_le_host_supported_command(int s, int argc, char **argv) 
+{
+	ng_hci_read_le_host_supported_rp rp;
+	int n;
+	n = sizeof(rp);
+	if (hci_simple_request(s, NG_HCI_OPCODE(NG_HCI_OGF_HC_BASEBAND,
+			NG_HCI_OCF_READ_LE_HOST_SUPPORTED),
+			(char *) &rp, &n) == ERROR)
+		return (ERROR);
+
+	if (rp.status != 0x00) {
+		fprintf(stdout, "Status: %s [%#02x]\n", 
+			hci_status2str(rp.status), rp.status);
+		return (FAILED);
+	}
+
+	fprintf(stdout, "LE Host support: %#02x\n", rp.le_supported_host);
+	fprintf(stdout, "Simulateneouse LE Host : %#02x\n", rp.simultaneous_le_host);
+
+	return (OK);
+	
+}
+static int
+hci_write_le_host_supported_command(int s, int argc, char **argv) 
+{
+	ng_hci_write_le_host_supported_cp cp;
+	ng_hci_write_le_host_supported_rp rp;
+
+	int n;
+
+	cp.le_supported_host = 0;
+	cp.simultaneous_le_host = 0;
+	switch (argc) {
+	case 2:
+		if (sscanf(argv[1], "%d", &n) != 1 || (n != 0 && n != 1)){
+			printf("ARGC2: %d\n", n);
+			return (USAGE);
+		}
+		cp.simultaneous_le_host = (n &1);
+		
+	case 1:
+		if (sscanf(argv[0], "%d", &n) != 1 || (n != 0 && n != 1)){
+			printf("ARGC1: %d\n", n);
+			return (USAGE);
+		}
+
+		cp.le_supported_host = (n &1);
+		break;
+
+	default:
+		return (USAGE);
+	}
+
+
+	/* send command */
+	n = sizeof(rp);
+	if (hci_request(s, NG_HCI_OPCODE(NG_HCI_OGF_HC_BASEBAND,
+			NG_HCI_OCF_WRITE_LE_HOST_SUPPORTED),
+			(char const *) &cp, sizeof(cp),
+			(char *) &rp, &n) == ERROR)
+		return (ERROR);
+
+	if (rp.status != 0x00) {
+		fprintf(stdout, "Status: %s [%#02x]\n", 
+			hci_status2str(rp.status), rp.status);
+		return (FAILED);
+	}
+
+	return (OK);
+}
+
 struct hci_command	host_controller_baseband_commands[] = {
 {
 "reset",
@@ -1872,6 +1945,17 @@ struct hci_command	host_controller_baseband_commands[] = {
 "\t0x03 - Optional Page Scan Mode III",
 &hci_write_page_scan_mode
 },
+{
+"read_le_host_supported_command",	\
+"Read if this host is in le supported mode and stimulatenouse le supported mode",
+&hci_read_le_host_supported_command,
+},  
+{
+"write_le_host_supported_command",	\
+"write_le_host_supported_command le_host[0|1] stimultajeous_le[0|1]",
+&hci_write_le_host_supported_command,
+},  
+
 { NULL, }
 };
 
diff --git a/usr.sbin/bluetooth/hccontrol/info.c b/usr.sbin/bluetooth/hccontrol/info.c
index d7bad36..ee9d1a1 100644
--- a/usr.sbin/bluetooth/hccontrol/info.c
+++ b/usr.sbin/bluetooth/hccontrol/info.c
@@ -29,6 +29,7 @@
  * $FreeBSD$
  */
 
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <errno.h>
 #include <stdio.h>
diff --git a/usr.sbin/bluetooth/hccontrol/le.c b/usr.sbin/bluetooth/hccontrol/le.c
new file mode 100644
index 0000000..afb151e
--- /dev/null
+++ b/usr.sbin/bluetooth/hccontrol/le.c
@@ -0,0 +1,356 @@
+/*
+ * le.c
+ *
+ * Copyright (c) 2015 Takanori Watanabe <takawata@freebsd.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $Id: hccontrol.c,v 1.5 2003/09/05 00:38:24 max Exp $
+ * $FreeBSD$
+ */
+
+#include <sys/types.h>
+#include <sys/ioctl.h>
+#include <sys/sysctl.h>
+#include <sys/bitstring.h>
+#include <sys/select.h>
+#include <assert.h>
+#include <err.h>
+#include <errno.h>
+#include <netgraph/ng_message.h>
+#include <errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+#include <stdint.h>
+#define L2CAP_SOCKET_CHECKED
+#include <bluetooth.h>
+#include "hccontrol.h"
+
+static int le_set_scan_param(int s, int argc, char *argv[]);
+static int le_set_scan_enable(int s, int argc, char *argv[]);
+static int parse_param(int argc, char *argv[], char *buf, int *len);
+static int le_set_scan_response(int s, int argc, char *argv[]);
+static int le_read_supported_status(int s, int argc, char *argv[]);
+static int le_read_local_supported_features(int s, int argc ,char *argv[]);
+static int set_le_event_mask(int s, uint64_t mask);
+static int set_event_mask(int s, uint64_t mask);
+static int le_enable(int s, int argc, char *argv[]);
+
+static int
+le_set_scan_param(int s, int argc, char *argv[])
+{
+	int type;
+	int interval;
+	int window;
+	int adrtype;
+	int policy;
+	int e, n;
+
+	ng_hci_le_set_scan_parameters_cp cp;
+	ng_hci_le_set_scan_parameters_rp rp;
+
+	if (argc != 5)
+		return USAGE;
+	
+	if (strcmp(argv[0], "active") == 0)
+		type = 1;
+	else if (strcmp(argv[0], "passive") == 0)
+		type = 0;
+	else
+		return USAGE;
+
+	interval = (int)(atof(argv[1])/0.625);
+	interval = (interval < 4)? 4: interval;
+	window = (int)(atof(argv[2])/0.625);
+	window = (window < 4) ? 4 : interval;
+	
+	if (strcmp(argv[3], "public") == 0)
+		adrtype = 0;
+	else if (strcmp(argv[0], "random") == 0)
+		adrtype = 1;
+	else
+		return USAGE;
+
+	if (strcmp(argv[4], "all") == 0)
+		policy = 0;
+	else if (strcmp(argv[4], "whitelist") == 0)
+		policy = 1;
+	else
+		return USAGE;
+
+	cp.le_scan_type = type;
+	cp.le_scan_interval = interval;
+	cp.own_address_type = adrtype;
+	cp.le_scan_window = window;
+	cp.scanning_filter_policy = policy;
+	n = sizeof(rp);
+	e = hci_request(s, NG_HCI_OPCODE(NG_HCI_OGF_LE,
+		NG_HCI_OCF_LE_SET_SCAN_PARAMETERS), 
+		(void *)&cp, sizeof(cp), (void *)&rp, &n);
+
+	return 0;
+}
+
+static int
+le_set_scan_enable(int s, int argc, char *argv[])
+{
+	ng_hci_le_set_scan_enable_cp cp;
+	ng_hci_le_set_scan_enable_rp rp;
+	int e, n, enable = 0;
+
+	if (argc != 1)
+		return USAGE;
+	  
+	if (strcmp(argv[0], "enable") == 0)
+		enable = 1;
+	else if (strcmp(argv[0], "disable") != 0)
+		return USAGE;
+
+	n = sizeof(rp);
+	cp.le_scan_enable = enable;
+	cp.filter_duplicates = 0;
+	e = hci_request(s, NG_HCI_OPCODE(NG_HCI_OGF_LE,
+		NG_HCI_OCF_LE_SET_SCAN_ENABLE), 
+		(void *)&cp, sizeof(cp), (void *)&rp, &n);
+			
+	if (e != 0 || rp.status != 0)
+		return ERROR;
+
+	return OK;
+}
+
+static int
+parse_param(int argc, char *argv[], char *buf, int *len)
+{
+	char *buflast  =  buf + (*len);
+	char *curbuf = buf;
+	char *token,*lenpos;
+	int ch;
+	int datalen;
+	uint16_t value;
+	optreset = 1;
+	optind = 0;
+	while ((ch = getopt(argc, argv , "n:f:u:")) != -1) {
+		switch(ch){
+		case 'n':
+			datalen = strlen(optarg);
+			if ((curbuf + datalen + 2) >= buflast)
+				goto done;
+			curbuf[0] = datalen + 1;
+			curbuf[1] = 8;
+			curbuf += 2;
+			memcpy(curbuf, optarg, datalen);
+			curbuf += datalen;
+			break;
+		case 'f':
+			if (curbuf+3 > buflast)
+				goto done;
+			curbuf[0] = 2;
+			curbuf[1] = 1;
+			curbuf[2] = atoi(optarg);
+			curbuf += 3;
+			break;
+		case 'u':
+			lenpos = buf;
+			if ((buf+2) >= buflast)
+				goto done;
+			curbuf[1] = 2;
+			*lenpos = 1;
+			curbuf += 2;
+			while ((token = strsep(&optarg, ",")) != NULL) {
+				value = strtol(token, NULL, 16);
+				if ((curbuf+2) >= buflast)
+					break;
+				curbuf[0] = value &0xff;
+				curbuf[1] = (value>>8)&0xff;
+				curbuf += 2;
+			}
+				
+		}
+	}
+done:
+	*len = curbuf - buf;
+
+	return OK;
+}
+
+static int
+le_set_scan_response(int s, int argc, char *argv[])
+{
+	ng_hci_le_set_scan_response_data_cp cp;
+	ng_hci_le_set_scan_response_data_rp rp;
+	int n;
+	int e;
+	int len;
+	char buf[NG_HCI_ADVERTISING_DATA_SIZE];
+
+	len = sizeof(buf);
+	parse_param(argc, argv, buf, &len);
+	memset(cp.scan_response_data, 0, sizeof(cp.scan_response_data));
+	cp.scan_response_data_length = len;
+	memcpy(cp.scan_response_data, buf, len);
+	n = sizeof(rp);
+	e = hci_request(s, NG_HCI_OPCODE(NG_HCI_OGF_LE,
+			NG_HCI_OCF_LE_SET_SCAN_RESPONSE_DATA), 
+			(void *)&cp, sizeof(cp), (void *)&rp, &n);
+			
+	printf("SET SCAN RESPONSE %d %d %d\n", e, rp.status, n);
+
+	return OK;
+}
+
+static int
+le_read_local_supported_features(int s, int argc ,char *argv[])
+{
+	ng_hci_le_read_local_supported_features_rp rp;
+	int e;
+	int n = sizeof(rp);
+
+	e = hci_simple_request(s,
+			NG_HCI_OPCODE(NG_HCI_OGF_LE,
+			NG_HCI_OCF_LE_READ_LOCAL_SUPPORTED_FEATURES), 
+			(void *)&rp, &n);
+
+	printf("LOCAL SUPPORTED: %d %d %jx\n", e, rp.status,
+	       (uintmax_t) rp.le_features);
+
+	return 0;
+}
+
+static int
+le_read_supported_status(int s, int argc, char *argv[])
+{
+	ng_hci_le_read_supported_status_rp rp;
+	int e;
+	int n = sizeof(rp);
+
+	e = hci_simple_request(s, NG_HCI_OPCODE(
+					NG_HCI_OGF_LE,
+					NG_HCI_OCF_LE_READ_SUPPORTED_STATUS),
+			       		(void *)&rp, &n);
+
+	printf("LE_STATUS: %d %d %jx\n", e, rp.status, (uintmax_t)rp.le_status);
+
+	return 0;
+}
+
+static int
+set_le_event_mask(int s, uint64_t mask)
+{
+	ng_hci_le_set_event_mask_cp semc;
+	ng_hci_le_set_event_mask_rp rp;  
+	int i, n ,e;
+	
+	n = sizeof(rp);
+	
+	for (i=0; i < NG_HCI_LE_EVENT_MASK_SIZE; i++) {
+		semc.event_mask[i] = mask&0xff;
+		mask >>= 8;
+	}
+	e = hci_request(s, NG_HCI_OPCODE(NG_HCI_OGF_LE,
+			NG_HCI_OCF_LE_SET_EVENT_MASK),
+			(void *)&semc, sizeof(semc), (void *)&rp, &n);
+	
+	return 0;
+}
+
+static int
+set_event_mask(int s, uint64_t mask)
+{
+	ng_hci_set_event_mask_cp semc;
+	ng_hci_set_event_mask_rp rp;  
+	int i, n, e;
+	
+	n = sizeof(rp);
+	
+	for (i=0; i < NG_HCI_EVENT_MASK_SIZE; i++) {
+		semc.event_mask[i] = mask&0xff;
+		mask >>= 8;
+	}
+	e = hci_request(s, NG_HCI_OPCODE(NG_HCI_OGF_HC_BASEBAND,
+			NG_HCI_OCF_SET_EVENT_MASK),
+			(void *)&semc, sizeof(semc), (void *)&rp, &n);
+	
+	return 0;
+}
+
+static
+int le_enable(int s, int argc, char *argv[])
+{
+	if (argc != 1)
+		return USAGE;
+	
+	if (strcasecmp(argv[0], "enable") == 0) {
+		set_event_mask(s, NG_HCI_EVENT_MASK_DEFAULT |
+			       NG_HCI_EVENT_MASK_LE);
+		set_le_event_mask(s, NG_HCI_LE_EVENT_MASK_ALL);
+	} else if (strcasecmp(argv[0], "disble") == 0)
+		set_event_mask(s, NG_HCI_EVENT_MASK_DEFAULT);
+	else
+		return USAGE;
+
+	return OK;
+}
+
+struct hci_command le_commands[] = {
+{
+	"le_enable",
+	"le_enable [enable|disable] \n"
+	"Enable LE event ",
+	&le_enable,
+},
+  {
+	  "le_read_local_supported_features",
+	  "le_read_local_supported_features\n" 
+	  "read local supported features mask",
+	  &le_read_local_supported_features,
+  },
+  {
+	  "le_read_supported_status",
+	  "le_read_supported_status\n"
+	  "read supported status"	  
+	  ,
+	  &le_read_supported_status,
+  },
+  {
+	  "le_set_scan_response",
+	  "le_set_scan_response -n $name -f $flag -u $uuid16,$uuid16 \n"
+	  "set LE scan response data"
+	  ,
+	  &le_set_scan_response,
+  },
+  {
+	  "le_set_scan_enable",
+	  "le_set_scan_enable [enable|disable] \n"
+	  "enable or disable LE device scan",
+	  &le_set_scan_enable
+  },
+  {
+	  "le_set_scan_param",
+	  "le_set_scan_param [active|passive] interval(ms) window(ms) [public|random] [all|whitelist] \n"
+	  "set LE device scan parameter",
+	  &le_set_scan_param
+  },
+};
diff --git a/usr.sbin/bluetooth/hccontrol/link_control.c b/usr.sbin/bluetooth/hccontrol/link_control.c
index 536520a..a55426c 100644
--- a/usr.sbin/bluetooth/hccontrol/link_control.c
+++ b/usr.sbin/bluetooth/hccontrol/link_control.c
@@ -29,6 +29,7 @@
  * $FreeBSD$
  */
 
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <errno.h>
 #include <stdio.h>
diff --git a/usr.sbin/bluetooth/hccontrol/link_policy.c b/usr.sbin/bluetooth/hccontrol/link_policy.c
index 67b32d5..8142b23 100644
--- a/usr.sbin/bluetooth/hccontrol/link_policy.c
+++ b/usr.sbin/bluetooth/hccontrol/link_policy.c
@@ -29,6 +29,7 @@
  * $FreeBSD$
  */
 
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <errno.h>
 #include <stdio.h>
diff --git a/usr.sbin/bluetooth/hccontrol/node.c b/usr.sbin/bluetooth/hccontrol/node.c
index ede2153..fb6fd19 100644
--- a/usr.sbin/bluetooth/hccontrol/node.c
+++ b/usr.sbin/bluetooth/hccontrol/node.c
@@ -30,6 +30,7 @@
  */
 
 #include <sys/ioctl.h>
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <errno.h>
 #include <netgraph/ng_message.h>
diff --git a/usr.sbin/bluetooth/hccontrol/util.c b/usr.sbin/bluetooth/hccontrol/util.c
index 4bb5000..1b05170 100644
--- a/usr.sbin/bluetooth/hccontrol/util.c
+++ b/usr.sbin/bluetooth/hccontrol/util.c
@@ -30,6 +30,7 @@
  */
  
 #include <sys/param.h>
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <stdio.h>
 #include <string.h>
@@ -151,7 +152,12 @@ hci_ver2str(int ver)
 		/* 0x00 */ "Bluetooth HCI Specification 1.0B",
 		/* 0x01 */ "Bluetooth HCI Specification 1.1",
 		/* 0x02 */ "Bluetooth HCI Specification 1.2",
-		/* 0x03 */ "Bluetooth HCI Specification 2.0"
+		/* 0x03 */ "Bluetooth HCI Specification 2.0",
+		/* 0x04 */ "Bluetooth HCI Specification 2.1",
+		/* 0x05 */ "Bluetooth HCI Specification 3.0",
+		/* 0x06 */ "Bluetooth HCI Specification 4.0",
+		/* 0x07 */ "Bluetooth HCI Specification 4.1",
+		/* 0x08 */ "Bluetooth HCI Specification 4.2"		
 	};
 
 	return (ver >= SIZE(t)? "?" : t[ver]);
@@ -164,7 +170,12 @@ hci_lmpver2str(int ver)
 		/* 0x00 */ "Bluetooth LMP 1.0",
 		/* 0x01 */ "Bluetooth LMP 1.1",
 		/* 0x02 */ "Bluetooth LMP 1.2",
-		/* 0x03 */ "Bluetooth LMP 2.0"
+		/* 0x03 */ "Bluetooth LMP 2.0",
+		/* 0x04 */ "Bluetooth LMP 2.1",
+		/* 0x04 */ "Bluetooth LMP 3.0",
+		/* 0x04 */ "Bluetooth LMP 4.0",
+		/* 0x04 */ "Bluetooth LMP 4.1",
+		/* 0x04 */ "Bluetooth LMP 4.2"		
 	};
 
 	return (ver >= SIZE(t)? "?" : t[ver]);
diff --git a/usr.sbin/bluetooth/hcsecd/hcsecd.c b/usr.sbin/bluetooth/hcsecd/hcsecd.c
index 72f9c8c..15b5ca4 100644
--- a/usr.sbin/bluetooth/hcsecd/hcsecd.c
+++ b/usr.sbin/bluetooth/hcsecd/hcsecd.c
@@ -30,6 +30,7 @@
  */
 
 #include <sys/queue.h>
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <err.h>
 #include <errno.h>
diff --git a/usr.sbin/bluetooth/hcsecd/parser.y b/usr.sbin/bluetooth/hcsecd/parser.y
index ec91c48..cfaeb02 100644
--- a/usr.sbin/bluetooth/hcsecd/parser.y
+++ b/usr.sbin/bluetooth/hcsecd/parser.y
@@ -32,6 +32,7 @@
 
 #include <sys/fcntl.h>
 #include <sys/queue.h>
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <errno.h>
 #include <limits.h>
diff --git a/usr.sbin/bluetooth/l2control/l2cap.c b/usr.sbin/bluetooth/l2control/l2cap.c
index c23106c..44009ef 100644
--- a/usr.sbin/bluetooth/l2control/l2cap.c
+++ b/usr.sbin/bluetooth/l2control/l2cap.c
@@ -30,6 +30,7 @@
  */
 
 #include <sys/ioctl.h>
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <errno.h>
 #include <stdio.h>
diff --git a/usr.sbin/bluetooth/l2control/l2control.c b/usr.sbin/bluetooth/l2control/l2control.c
index fdbf2f5b..87ec237 100644
--- a/usr.sbin/bluetooth/l2control/l2control.c
+++ b/usr.sbin/bluetooth/l2control/l2control.c
@@ -30,6 +30,7 @@
  */
 
 #include <assert.h>
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <err.h>
 #include <errno.h>
diff --git a/usr.sbin/bluetooth/l2ping/l2ping.c b/usr.sbin/bluetooth/l2ping/l2ping.c
index 4baa354..92e7a0a 100644
--- a/usr.sbin/bluetooth/l2ping/l2ping.c
+++ b/usr.sbin/bluetooth/l2ping/l2ping.c
@@ -34,6 +34,7 @@
 #include <arpa/inet.h>
 #include <netinet/in.h>
 #include <assert.h>
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <err.h>
 #include <errno.h>
diff --git a/usr.sbin/bluetooth/rfcomm_pppd/rfcomm_pppd.c b/usr.sbin/bluetooth/rfcomm_pppd/rfcomm_pppd.c
index 956dc4d..e970fb0 100644
--- a/usr.sbin/bluetooth/rfcomm_pppd/rfcomm_pppd.c
+++ b/usr.sbin/bluetooth/rfcomm_pppd/rfcomm_pppd.c
@@ -30,7 +30,7 @@
  * $Id: rfcomm_pppd.c,v 1.5 2003/09/07 18:32:11 max Exp $
  * $FreeBSD$
  */
-
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <ctype.h>
 #include <err.h>
diff --git a/usr.sbin/bluetooth/sdpcontrol/sdpcontrol.c b/usr.sbin/bluetooth/sdpcontrol/sdpcontrol.c
index fca2015..65ee3d0 100644
--- a/usr.sbin/bluetooth/sdpcontrol/sdpcontrol.c
+++ b/usr.sbin/bluetooth/sdpcontrol/sdpcontrol.c
@@ -30,6 +30,7 @@
  */
 
 #include <assert.h>
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <err.h>
 #include <errno.h>
diff --git a/usr.sbin/bluetooth/sdpcontrol/search.c b/usr.sbin/bluetooth/sdpcontrol/search.c
index e7d8244..acc8c16 100644
--- a/usr.sbin/bluetooth/sdpcontrol/search.c
+++ b/usr.sbin/bluetooth/sdpcontrol/search.c
@@ -30,6 +30,7 @@
  */
 
 #include <netinet/in.h>
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <ctype.h>
 #include <sdp.h>
diff --git a/usr.sbin/bluetooth/sdpd/bgd.c b/usr.sbin/bluetooth/sdpd/bgd.c
index 70dda89..2c4e4d9 100644
--- a/usr.sbin/bluetooth/sdpd/bgd.c
+++ b/usr.sbin/bluetooth/sdpd/bgd.c
@@ -28,7 +28,7 @@
  * $Id: bgd.c,v 1.4 2004/01/13 01:54:39 max Exp $
  * $FreeBSD$
  */
-
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <sdp.h>
 #include <string.h>
diff --git a/usr.sbin/bluetooth/sdpd/dun.c b/usr.sbin/bluetooth/sdpd/dun.c
index e7aeb78..1496285 100644
--- a/usr.sbin/bluetooth/sdpd/dun.c
+++ b/usr.sbin/bluetooth/sdpd/dun.c
@@ -30,6 +30,7 @@
  */
 
 #include <sys/queue.h>
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <sdp.h>
 #include <string.h>
diff --git a/usr.sbin/bluetooth/sdpd/ftrn.c b/usr.sbin/bluetooth/sdpd/ftrn.c
index bcebfc7..bc1095e 100644
--- a/usr.sbin/bluetooth/sdpd/ftrn.c
+++ b/usr.sbin/bluetooth/sdpd/ftrn.c
@@ -30,6 +30,7 @@
  */
 
 #include <sys/queue.h>
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <sdp.h>
 #include <string.h>
diff --git a/usr.sbin/bluetooth/sdpd/gn.c b/usr.sbin/bluetooth/sdpd/gn.c
index d35c0ee..c2bea48 100644
--- a/usr.sbin/bluetooth/sdpd/gn.c
+++ b/usr.sbin/bluetooth/sdpd/gn.c
@@ -32,6 +32,7 @@
  */
 
 #include <sys/queue.h>
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <sdp.h>
 #include <string.h>
diff --git a/usr.sbin/bluetooth/sdpd/irmc.c b/usr.sbin/bluetooth/sdpd/irmc.c
index d28a120..2b8f317 100644
--- a/usr.sbin/bluetooth/sdpd/irmc.c
+++ b/usr.sbin/bluetooth/sdpd/irmc.c
@@ -30,6 +30,7 @@
  */
 
 #include <sys/queue.h>
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <sdp.h>
 #include <string.h>
diff --git a/usr.sbin/bluetooth/sdpd/irmc_command.c b/usr.sbin/bluetooth/sdpd/irmc_command.c
index 10dafe0..a55e133 100644
--- a/usr.sbin/bluetooth/sdpd/irmc_command.c
+++ b/usr.sbin/bluetooth/sdpd/irmc_command.c
@@ -30,6 +30,7 @@
  */
 
 #include <sys/queue.h>
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <sdp.h>
 #include <string.h>
diff --git a/usr.sbin/bluetooth/sdpd/lan.c b/usr.sbin/bluetooth/sdpd/lan.c
index 2425a89..3ed2b12 100644
--- a/usr.sbin/bluetooth/sdpd/lan.c
+++ b/usr.sbin/bluetooth/sdpd/lan.c
@@ -31,6 +31,7 @@
 
 #include <arpa/inet.h>
 #include <sys/queue.h>
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <sdp.h>
 #include <stdio.h>
diff --git a/usr.sbin/bluetooth/sdpd/main.c b/usr.sbin/bluetooth/sdpd/main.c
index 1df3bf0..a287b9b 100644
--- a/usr.sbin/bluetooth/sdpd/main.c
+++ b/usr.sbin/bluetooth/sdpd/main.c
@@ -30,6 +30,7 @@
  */
 
 #include <sys/select.h>
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <errno.h>
 #include <grp.h>
diff --git a/usr.sbin/bluetooth/sdpd/nap.c b/usr.sbin/bluetooth/sdpd/nap.c
index 5a857d8..c034ee6 100644
--- a/usr.sbin/bluetooth/sdpd/nap.c
+++ b/usr.sbin/bluetooth/sdpd/nap.c
@@ -32,6 +32,7 @@
  */
 
 #include <sys/queue.h>
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <sdp.h>
 #include <string.h>
diff --git a/usr.sbin/bluetooth/sdpd/opush.c b/usr.sbin/bluetooth/sdpd/opush.c
index 36359da..bcdfda2 100644
--- a/usr.sbin/bluetooth/sdpd/opush.c
+++ b/usr.sbin/bluetooth/sdpd/opush.c
@@ -30,6 +30,7 @@
  */
 
 #include <sys/queue.h>
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <sdp.h>
 #include <string.h>
diff --git a/usr.sbin/bluetooth/sdpd/panu.c b/usr.sbin/bluetooth/sdpd/panu.c
index e00f650..5b2773e 100644
--- a/usr.sbin/bluetooth/sdpd/panu.c
+++ b/usr.sbin/bluetooth/sdpd/panu.c
@@ -32,6 +32,7 @@
  */
 
 #include <sys/queue.h>
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <sdp.h>
 #include <string.h>
diff --git a/usr.sbin/bluetooth/sdpd/profile.c b/usr.sbin/bluetooth/sdpd/profile.c
index f3dfaa7..5c25d03 100644
--- a/usr.sbin/bluetooth/sdpd/profile.c
+++ b/usr.sbin/bluetooth/sdpd/profile.c
@@ -32,6 +32,7 @@
  */
 
 #include <sys/queue.h>
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <sdp.h>
 #include <string.h>
diff --git a/usr.sbin/bluetooth/sdpd/provider.c b/usr.sbin/bluetooth/sdpd/provider.c
index b0f5347..0243305 100644
--- a/usr.sbin/bluetooth/sdpd/provider.c
+++ b/usr.sbin/bluetooth/sdpd/provider.c
@@ -30,6 +30,7 @@
  */
 
 #include <sys/queue.h>
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <string.h>
 #include <stdlib.h>
diff --git a/usr.sbin/bluetooth/sdpd/sar.c b/usr.sbin/bluetooth/sdpd/sar.c
index 4fc25d9..705f716 100644
--- a/usr.sbin/bluetooth/sdpd/sar.c
+++ b/usr.sbin/bluetooth/sdpd/sar.c
@@ -34,6 +34,7 @@
 #include <netinet/in.h>
 #include <arpa/inet.h>
 #include <assert.h>
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <errno.h>
 #include <sdp.h>
diff --git a/usr.sbin/bluetooth/sdpd/scr.c b/usr.sbin/bluetooth/sdpd/scr.c
index d0c9ec5..1df72d1 100644
--- a/usr.sbin/bluetooth/sdpd/scr.c
+++ b/usr.sbin/bluetooth/sdpd/scr.c
@@ -30,6 +30,7 @@
  */
 
 #include <sys/queue.h>
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <errno.h>
 #include <sdp.h>
diff --git a/usr.sbin/bluetooth/sdpd/sd.c b/usr.sbin/bluetooth/sdpd/sd.c
index 1743ea7..c5397ce 100644
--- a/usr.sbin/bluetooth/sdpd/sd.c
+++ b/usr.sbin/bluetooth/sdpd/sd.c
@@ -30,6 +30,7 @@
  */
 
 #include <sys/queue.h>
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <sdp.h>
 #include <string.h>
diff --git a/usr.sbin/bluetooth/sdpd/server.c b/usr.sbin/bluetooth/sdpd/server.c
index 4ef153b..abd1815 100644
--- a/usr.sbin/bluetooth/sdpd/server.c
+++ b/usr.sbin/bluetooth/sdpd/server.c
@@ -38,6 +38,7 @@
 #include <netinet/in.h>
 #include <arpa/inet.h>
 #include <assert.h>
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <errno.h>
 #include <pwd.h>
diff --git a/usr.sbin/bluetooth/sdpd/sp.c b/usr.sbin/bluetooth/sdpd/sp.c
index 31a9585a..48edc77 100644
--- a/usr.sbin/bluetooth/sdpd/sp.c
+++ b/usr.sbin/bluetooth/sdpd/sp.c
@@ -30,6 +30,7 @@
  */
 
 #include <sys/queue.h>
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <sdp.h>
 #include <string.h>
diff --git a/usr.sbin/bluetooth/sdpd/srr.c b/usr.sbin/bluetooth/sdpd/srr.c
index fd636d5..60f48ca 100644
--- a/usr.sbin/bluetooth/sdpd/srr.c
+++ b/usr.sbin/bluetooth/sdpd/srr.c
@@ -34,6 +34,7 @@
 #include <netinet/in.h>
 #include <arpa/inet.h>
 #include <assert.h>
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <errno.h>
 #include <sdp.h>
diff --git a/usr.sbin/bluetooth/sdpd/ssar.c b/usr.sbin/bluetooth/sdpd/ssar.c
index eac9235..5e52e80 100644
--- a/usr.sbin/bluetooth/sdpd/ssar.c
+++ b/usr.sbin/bluetooth/sdpd/ssar.c
@@ -30,6 +30,7 @@
  */
 
 #include <sys/queue.h>
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <sdp.h>
 #include <string.h>
diff --git a/usr.sbin/bluetooth/sdpd/ssr.c b/usr.sbin/bluetooth/sdpd/ssr.c
index ac27548..785c8ca 100644
--- a/usr.sbin/bluetooth/sdpd/ssr.c
+++ b/usr.sbin/bluetooth/sdpd/ssr.c
@@ -34,6 +34,7 @@
 #include <netinet/in.h>
 #include <arpa/inet.h>
 #include <assert.h>
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <errno.h>
 #include <sdp.h>
diff --git a/usr.sbin/bluetooth/sdpd/sur.c b/usr.sbin/bluetooth/sdpd/sur.c
index 143eaf3..581b593 100644
--- a/usr.sbin/bluetooth/sdpd/sur.c
+++ b/usr.sbin/bluetooth/sdpd/sur.c
@@ -30,6 +30,7 @@
  */
 
 #include <sys/queue.h>
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <errno.h>
 #include <sdp.h>
diff --git a/usr.sbin/bluetooth/sdpd/uuid.c b/usr.sbin/bluetooth/sdpd/uuid.c
index 1989bc5..dff8d2c 100644
--- a/usr.sbin/bluetooth/sdpd/uuid.c
+++ b/usr.sbin/bluetooth/sdpd/uuid.c
@@ -28,7 +28,7 @@
  * $Id: uuid.c,v 1.1 2004/12/09 18:20:26 max Exp $
  * $FreeBSD$
  */
-
+#define L2CAP_SOCKET_CHECKED
 #include <bluetooth.h>
 #include <sdp.h>
 #include <uuid.h>
diff --git a/usr.sbin/bsdinstall/scripts/zfsboot b/usr.sbin/bsdinstall/scripts/zfsboot
index edd9f59..eb90b8c 100755
--- a/usr.sbin/bsdinstall/scripts/zfsboot
+++ b/usr.sbin/bsdinstall/scripts/zfsboot
@@ -1128,6 +1128,9 @@ zfs_create_boot()
 			f_eval_catch $funcname dd "$DD_WITH_OPTIONS" \
 			             /dev/random "$bootpool/$zroot_key" \
 			             "bs=4096 count=1" || return $FAILURE
+			f_eval_catch $funcname chmod "$CHMOD_MODE" \
+			             go-wrx "$bootpool/$zroot_key" ||
+			             return $FAILURE
 		else
 			# Clean up
 			f_eval_catch $funcname zfs "$ZFS_UNMOUNT" \
@@ -1343,6 +1346,9 @@ zfs_create_boot()
 		$BSDINSTALL_TMPBOOT/loader.conf.aesni || return $FAILURE
 	f_eval_catch $funcname echo "$ECHO_APPEND" 'geom_eli_load=\"YES\"' \
 		$BSDINSTALL_TMPBOOT/loader.conf.geli || return $FAILURE
+	f_eval_catch $funcname echo "$ECHO_APPEND" \
+		'geom_eli_passphrase_prompt=\"YES\"' \
+		$BSDINSTALL_TMPBOOT/loader.conf.geli || return $FAILURE
 	for disk in $disks; do
 		f_eval_catch $funcname printf "$PRINTF_CONF" \
 			geli_%s_keyfile0_load "$disk$targetpart YES" \
diff --git a/usr.sbin/bsnmpd/tools/bsnmptools/Makefile b/usr.sbin/bsnmpd/tools/bsnmptools/Makefile
index 49afd94..f63975b 100644
--- a/usr.sbin/bsnmpd/tools/bsnmptools/Makefile
+++ b/usr.sbin/bsnmpd/tools/bsnmptools/Makefile
@@ -10,10 +10,6 @@ PROG=	bsnmpget
 LIBADD=	bsnmp bsnmptools
 CFLAGS+=	-I${.CURDIR}/../libbsnmptools
 
-.if ${MK_OPENSSL} != "no"
-LIBADD+=	crypto
-.endif
-
 LINKS=  ${BINDIR}/bsnmpget ${BINDIR}/bsnmpwalk
 LINKS+=  ${BINDIR}/bsnmpget ${BINDIR}/bsnmpset
 
diff --git a/usr.sbin/chown/chgrp.1 b/usr.sbin/chown/chgrp.1
index 8a4c271..6fb0a31 100644
--- a/usr.sbin/chown/chgrp.1
+++ b/usr.sbin/chown/chgrp.1
@@ -31,7 +31,7 @@
 .\"     @(#)chgrp.1	8.3 (Berkeley) 3/31/94
 .\" $FreeBSD$
 .\"
-.Dd February 21, 2010
+.Dd April 20, 2015
 .Dt CHGRP 1
 .Os
 .Sh NAME
@@ -60,8 +60,9 @@ The following options are available:
 .It Fl H
 If the
 .Fl R
-option is specified, symbolic links on the command line are followed.
-(Symbolic links encountered in the tree traversal are not followed.)
+option is specified, symbolic links on the command line are followed
+and hence unaffected by the command.
+(Symbolic links encountered during traversal are not followed.)
 .It Fl L
 If the
 .Fl R
@@ -72,8 +73,12 @@ If the
 option is specified, no symbolic links are followed.
 This is the default.
 .It Fl R
-Change the group ID for the file hierarchies rooted
-in the files instead of just the files themselves.
+Change the group ID of the file hierarchies rooted in the files,
+instead of just the files themselves.
+Beware of unintentionally matching the
+.Dq Pa ".."
+hard link to the parent directory when using wildcards like
+.Dq Li ".*" .
 .It Fl f
 The force option ignores errors, except for usage errors and does not
 query about strange modes (unless the user does not have proper permissions).
diff --git a/usr.sbin/chown/chown.8 b/usr.sbin/chown/chown.8
index b5882a3..6b82728 100644
--- a/usr.sbin/chown/chown.8
+++ b/usr.sbin/chown/chown.8
@@ -28,7 +28,7 @@
 .\"     @(#)chown.8	8.3 (Berkeley) 3/31/94
 .\" $FreeBSD$
 .\"
-.Dd February 21, 2010
+.Dd April 20, 2015
 .Dt CHOWN 8
 .Os
 .Sh NAME
@@ -64,8 +64,9 @@ The options are as follows:
 .It Fl H
 If the
 .Fl R
-option is specified, symbolic links on the command line are followed.
-(Symbolic links encountered in the tree traversal are not followed.)
+option is specified, symbolic links on the command line are followed
+and hence unaffected by the command.
+(Symbolic links encountered during traversal are not followed.)
 .It Fl L
 If the
 .Fl R
@@ -76,8 +77,8 @@ If the
 option is specified, no symbolic links are followed.
 This is the default.
 .It Fl R
-Change the user ID and/or the group ID of the specified directory trees
-(recursively, including their contents) and files.
+Change the user ID and/or the group ID of the file hierarchies rooted
+in the files, instead of just the files themselves.
 Beware of unintentionally matching the
 .Dq Pa ".."
 hard link to the parent directory when using wildcards like
diff --git a/usr.sbin/chown/chown.c b/usr.sbin/chown/chown.c
index 9780f02..457068a 100644
--- a/usr.sbin/chown/chown.c
+++ b/usr.sbin/chown/chown.c
@@ -47,6 +47,7 @@ __FBSDID("$FreeBSD$");
 
 #include <err.h>
 #include <errno.h>
+#include <fcntl.h>
 #include <fts.h>
 #include <grp.h>
 #include <libgen.h>
@@ -119,18 +120,24 @@ main(int argc, char **argv)
 		usage();
 
 	if (Rflag) {
-		fts_options = FTS_PHYSICAL;
 		if (hflag && (Hflag || Lflag))
 			errx(1, "the -R%c and -h options may not be "
 			    "specified together", Hflag ? 'H' : 'L');
-		if (Hflag)
-			fts_options |= FTS_COMFOLLOW;
-		else if (Lflag) {
-			fts_options &= ~FTS_PHYSICAL;
-			fts_options |= FTS_LOGICAL;
+		if (Lflag) {
+			fts_options = FTS_LOGICAL;
+		} else {
+			fts_options = FTS_PHYSICAL;
+
+			if (Hflag) {
+				fts_options |= FTS_COMFOLLOW;
+			}
 		}
-	} else
-		fts_options = hflag ? FTS_PHYSICAL : FTS_LOGICAL;
+	} else if (hflag) {
+		fts_options = FTS_PHYSICAL;
+	} else {
+		fts_options = FTS_LOGICAL;
+	}
+
 	if (xflag)
 		fts_options |= FTS_XDEV;
 
@@ -156,6 +163,15 @@ main(int argc, char **argv)
 		err(1, NULL);
 
 	for (rval = 0; (p = fts_read(ftsp)) != NULL;) {
+		int atflag;
+
+		if ((fts_options & FTS_LOGICAL) ||
+		    ((fts_options & FTS_COMFOLLOW) &&
+		    p->fts_level == FTS_ROOTLEVEL))
+			atflag = 0;
+		else
+			atflag = AT_SYMLINK_NOFOLLOW;
+
 		switch (p->fts_info) {
 		case FTS_D:			/* Change it at FTS_DP. */
 			if (!Rflag)
@@ -170,58 +186,44 @@ main(int argc, char **argv)
 			warnx("%s: %s", p->fts_path, strerror(p->fts_errno));
 			rval = 1;
 			continue;
-		case FTS_SL:
-		case FTS_SLNONE:
-			/*
-			 * The only symlinks that end up here are ones that
-			 * don't point to anything and ones that we found
-			 * doing a physical walk.
-			 */
-			if (hflag)
-				break;
-			else
-				continue;
 		default:
 			break;
 		}
 		if ((uid == (uid_t)-1 || uid == p->fts_statp->st_uid) &&
 		    (gid == (gid_t)-1 || gid == p->fts_statp->st_gid))
 			continue;
-		if ((hflag ? lchown : chown)(p->fts_accpath, uid, gid) == -1) {
-			if (!fflag) {
-				chownerr(p->fts_path);
-				rval = 1;
-			}
-		} else {
-			if (vflag) {
-				printf("%s", p->fts_path);
-				if (vflag > 1) {
-					if (ischown) {
-						printf(": %ju:%ju -> %ju:%ju",
-						    (uintmax_t)
-						    p->fts_statp->st_uid, 
-						    (uintmax_t)
-						    p->fts_statp->st_gid,
-						    (uid == (uid_t)-1) ? 
-						    (uintmax_t)
-						    p->fts_statp->st_uid : 
-						    (uintmax_t)uid,
-						    (gid == (gid_t)-1) ? 
-						    (uintmax_t)
-						    p->fts_statp->st_gid :
-						    (uintmax_t)gid);
-					} else {
-						printf(": %ju -> %ju",
-						    (uintmax_t)
-						    p->fts_statp->st_gid,
-						    (gid == (gid_t)-1) ? 
-						    (uintmax_t)
-						    p->fts_statp->st_gid : 
-						    (uintmax_t)gid);
-					}
+		if (fchownat(AT_FDCWD, p->fts_accpath, uid, gid, atflag)
+		    == -1 && !fflag) {
+			chownerr(p->fts_path);
+			rval = 1;
+		} else if (vflag) {
+			printf("%s", p->fts_path);
+			if (vflag > 1) {
+				if (ischown) {
+					printf(": %ju:%ju -> %ju:%ju",
+					    (uintmax_t)
+					    p->fts_statp->st_uid, 
+					    (uintmax_t)
+					    p->fts_statp->st_gid,
+					    (uid == (uid_t)-1) ? 
+					    (uintmax_t)
+					    p->fts_statp->st_uid : 
+					    (uintmax_t)uid,
+					    (gid == (gid_t)-1) ? 
+					    (uintmax_t)
+					    p->fts_statp->st_gid :
+					    (uintmax_t)gid);
+				} else {
+					printf(": %ju -> %ju",
+					    (uintmax_t)
+					    p->fts_statp->st_gid,
+					    (gid == (gid_t)-1) ? 
+					    (uintmax_t)
+					    p->fts_statp->st_gid : 
+					    (uintmax_t)gid);
 				}
-				printf("\n");
 			}
+			printf("\n");
 		}
 	}
 	if (errno)
diff --git a/usr.sbin/config/main.c b/usr.sbin/config/main.c
index 8875142..f2d2a70 100644
--- a/usr.sbin/config/main.c
+++ b/usr.sbin/config/main.c
@@ -686,7 +686,7 @@ kernconfdump(const char *file)
 {
 	struct stat st;
 	FILE *fp, *pp;
-	int error, len, osz, r;
+	int error, osz, r;
 	unsigned int i, off, size, t1, t2, align;
 	char *cmd, *o;
 
@@ -714,7 +714,7 @@ kernconfdump(const char *file)
 	if (pp == NULL)
 		errx(EXIT_FAILURE, "popen() failed");
 	free(cmd);
-	len = fread(o, osz, 1, pp);
+	fread(o, osz, 1, pp);
 	pclose(pp);
 	r = sscanf(o, "%d%d%d%d%d", &off, &size, &t1, &t2, &align);
 	free(o);
diff --git a/usr.sbin/crashinfo/crashinfo.sh b/usr.sbin/crashinfo/crashinfo.sh
index 557d810..3a55e5d 100755
--- a/usr.sbin/crashinfo/crashinfo.sh
+++ b/usr.sbin/crashinfo/crashinfo.sh
@@ -268,12 +268,6 @@ netstat -M $VMCORE -N $KERNEL -m
 echo
 
 echo "------------------------------------------------------------------------"
-echo "netstat -anr"
-echo
-netstat -M $VMCORE -N $KERNEL -anr
-echo
-
-echo "------------------------------------------------------------------------"
 echo "netstat -anA"
 echo
 netstat -M $VMCORE -N $KERNEL -anA
diff --git a/usr.sbin/crunch/crunchide/Makefile b/usr.sbin/crunch/crunchide/Makefile
index fd23dec..467b0b6 100644
--- a/usr.sbin/crunch/crunchide/Makefile
+++ b/usr.sbin/crunch/crunchide/Makefile
@@ -1,24 +1,9 @@
 # $FreeBSD$
 
 PROG=   crunchide
-SRCS=	crunchide.c
+SRCS=	crunchide.c exec_elf32.c exec_elf64.c
 
-TARGET_ARCH?=	${MACHINE_ARCH}
-
-.if ${TARGET_ARCH} == i386 && ${MACHINE_ARCH} == i386
-CFLAGS+=-DNLIST_AOUT
-SRCS+=	exec_aout.c
-.endif
-
-.if ${TARGET_ARCH} == aarch64 || ${TARGET_ARCH} == amd64 || \
-    ${TARGET_ARCH} == powerpc64 || \
-    ${TARGET_ARCH} == sparc64 || ${TARGET_ARCH:Mmips64*}
-CFLAGS+=-DNLIST_ELF64
-SRCS+=	exec_elf64.c
+CFLAGS+=-DNLIST_ELF32 -DNLIST_ELF64
 exec_elf64.o: exec_elf32.c
-.else
-CFLAGS+=-DNLIST_ELF32
-SRCS+=	exec_elf32.c
-.endif
 
 .include <bsd.prog.mk>
diff --git a/usr.sbin/crunch/crunchide/crunchide.c b/usr.sbin/crunch/crunchide/crunchide.c
index d2b1123..8665a14 100644
--- a/usr.sbin/crunch/crunchide/crunchide.c
+++ b/usr.sbin/crunch/crunchide/crunchide.c
@@ -212,12 +212,6 @@ struct {
 	int	(*check)(int, const char *);	/* 1 if match, zero if not */
 	int	(*hide)(int, const char *);	/* non-zero if error */
 } exec_formats[] = {
-#ifdef NLIST_AOUT
-	{	"a.out",	check_aout,	hide_aout,	},
-#endif
-#ifdef NLIST_ECOFF
-	{	"ECOFF",	check_elf64,	hide_elf64,	},
-#endif
 #ifdef NLIST_ELF32
 	{	"ELF32",	check_elf32,	hide_elf32,	},
 #endif
diff --git a/usr.sbin/crunch/crunchide/exec_aout.c b/usr.sbin/crunch/crunchide/exec_aout.c
deleted file mode 100644
index a608c23..0000000
--- a/usr.sbin/crunch/crunchide/exec_aout.c
+++ /dev/null
@@ -1,198 +0,0 @@
-/*	$NetBSD: exec_aout.c,v 1.6 1997/08/02 21:30:17 perry Exp $	*/
-/*
- * Copyright (c) 1997 Christopher G. Demetriou.  All rights reserved.
- * Copyright (c) 1994 University of Maryland
- * All Rights Reserved.
- *
- * Permission to use, copy, modify, distribute, and sell this software and its
- * documentation for any purpose is hereby granted without fee, provided that
- * the above copyright notice appear in all copies and that both that
- * copyright notice and this permission notice appear in supporting
- * documentation, and that the name of U.M. not be used in advertising or
- * publicity pertaining to distribution of the software without specific,
- * written prior permission.  U.M. makes no representations about the
- * suitability of this software for any purpose.  It is provided "as is"
- * without express or implied warranty.
- *
- * U.M. DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO EVENT SHALL U.M.
- * BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION
- * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
- * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- *
- * Author: James da Silva, Systems Design and Analysis Group
- *			   Computer Science Department
- *			   University of Maryland at College Park
- */
-#include <sys/cdefs.h>
-#ifndef lint
-__RCSID("$NetBSD: exec_aout.c,v 1.6 1997/08/02 21:30:17 perry Exp $");
-__FBSDID("$FreeBSD$");
-#endif
- 
-#include <unistd.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <a.out.h>
-#include <sys/types.h>
-#include <sys/endian.h>
-#include <sys/stat.h> 
-#include <sys/errno.h>
-#include <netinet/in.h>
-
-#include "extern.h"
-
-#if defined(NLIST_AOUT)
-
-int nsyms, ntextrel, ndatarel;
-struct exec *hdrp;
-char *aoutdata, *strbase;
-struct relocation_info *textrel, *datarel;
-struct nlist *symbase;
-
-
-#define SYMSTR(sp)	(&strbase[(sp)->n_un.n_strx])
-
-/* is the symbol a global symbol defined in the current file? */
-#define IS_GLOBAL_DEFINED(sp) \
-                  (((sp)->n_type & N_EXT) && ((sp)->n_type & N_TYPE) != N_UNDF)
-
-/* is the relocation entry dependent on a symbol? */
-#define IS_SYMBOL_RELOC(rp)   \
-                  ((rp)->r_extern||(rp)->r_baserel||(rp)->r_jmptable)
-
-static void check_reloc(const char *filename, struct relocation_info *relp);
-
-int check_aout(int inf, const char *filename)
-{
-    struct stat infstat;
-    struct exec eh;
-
-    /*
-     * check the header to make sure it's an a.out-format file.
-     */
-
-    if(fstat(inf, &infstat) == -1)
-	return 0;
-    if(infstat.st_size < sizeof eh)
-	return 0;
-    if(read(inf, &eh, sizeof eh) != sizeof eh)
-	return 0;
-
-    if(N_BADMAG(eh))
-	return 0;
-
-    return 1;
-}
-
-int hide_aout(int inf, const char *filename)
-{
-    struct stat infstat;
-    struct relocation_info *relp;
-    struct nlist *symp;
-    int rc;
-
-    /*
-     * do some error checking.
-     */
-
-    if(fstat(inf, &infstat) == -1) {
-	perror(filename);
-	return 1;
-    }
-
-    /*
-     * Read the entire file into memory.  XXX - Really, we only need to
-     * read the header and from TRELOFF to the end of the file.
-     */
-
-    if((aoutdata = (char *) malloc(infstat.st_size)) == NULL) {
-	fprintf(stderr, "%s: too big to read into memory\n", filename);
-	return 1;
-    }
-
-    if((rc = read(inf, aoutdata, infstat.st_size)) < infstat.st_size) {
-	fprintf(stderr, "%s: read error: %s\n", filename,
-		rc == -1? strerror(errno) : "short read");
-	return 1;
-    }
-
-    /*
-     * Calculate offsets and sizes from the header.
-     */
-
-    hdrp = (struct exec *) aoutdata;
-
-#ifdef __FreeBSD__
-    textrel = (struct relocation_info *) (aoutdata + N_RELOFF(*hdrp));
-    datarel = (struct relocation_info *) (aoutdata + N_RELOFF(*hdrp) +
-					  hdrp->a_trsize);
-#else
-    textrel = (struct relocation_info *) (aoutdata + N_TRELOFF(*hdrp));
-    datarel = (struct relocation_info *) (aoutdata + N_DRELOFF(*hdrp));
-#endif
-    symbase = (struct nlist *)		 (aoutdata + N_SYMOFF(*hdrp));
-    strbase = (char *) 			 (aoutdata + N_STROFF(*hdrp));
-
-    ntextrel = hdrp->a_trsize / sizeof(struct relocation_info);
-    ndatarel = hdrp->a_drsize / sizeof(struct relocation_info);
-    nsyms    = hdrp->a_syms   / sizeof(struct nlist);
-
-    /*
-     * Zap the type field of all globally-defined symbols.  The linker will
-     * subsequently ignore these entries.  Don't zap any symbols in the
-     * keep list.
-     */
-
-    for(symp = symbase; symp < symbase + nsyms; symp++) {
-	if(!IS_GLOBAL_DEFINED(symp))		/* keep undefined syms */
-	    continue;
-
-	/* keep (C) symbols which are on the keep list */
-	if(SYMSTR(symp)[0] == '_' && in_keep_list(SYMSTR(symp) + 1))
-	    continue;
-
-	symp->n_type = 0;
-    }
-
-    /*
-     * Check whether the relocation entries reference any symbols that we
-     * just zapped.  I don't know whether ld can handle this case, but I
-     * haven't encountered it yet.  These checks are here so that the program
-     * doesn't fail silently should such symbols be encountered.
-     */
-
-    for(relp = textrel; relp < textrel + ntextrel; relp++)
-	check_reloc(filename, relp);
-    for(relp = datarel; relp < datarel + ndatarel; relp++)
-	check_reloc(filename, relp);
-
-    /*
-     * Write the .o file back out to disk.  XXX - Really, we only need to
-     * write the symbol table entries back out.
-     */
-    lseek(inf, 0, SEEK_SET);
-    if((rc = write(inf, aoutdata, infstat.st_size)) < infstat.st_size) {
-	fprintf(stderr, "%s: write error: %s\n", filename,
-		rc == -1? strerror(errno) : "short write");
-	return 1;
-    }
-
-    return 0;
-}
-
-
-static void check_reloc(const char *filename, struct relocation_info *relp)
-{
-    /* bail out if we zapped a symbol that is needed */
-    if(IS_SYMBOL_RELOC(relp) && symbase[relp->r_symbolnum].n_type == 0) {
-	fprintf(stderr,
-		"%s: oops, have hanging relocation for %s: bailing out!\n",
-		filename, SYMSTR(&symbase[relp->r_symbolnum]));
-	exit(1);
-    }
-}
-
-#endif /* defined(NLIST_AOUT) */
diff --git a/usr.sbin/crunch/crunchide/exec_elf32.c b/usr.sbin/crunch/crunchide/exec_elf32.c
index 10e7d27..89080e9 100644
--- a/usr.sbin/crunch/crunchide/exec_elf32.c
+++ b/usr.sbin/crunch/crunchide/exec_elf32.c
@@ -79,6 +79,9 @@ __FBSDID("$FreeBSD$");
 #define ELFNAME2(x,y)   CONCAT(x,CONCAT(_elf,CONCAT(ELFSIZE,CONCAT(_,y))))
 #define ELFNAMEEND(x)   CONCAT(x,CONCAT(_elf,ELFSIZE))
 #define ELFDEFNNAME(x)  CONCAT(ELF,CONCAT(ELFSIZE,CONCAT(_,x)))
+#ifndef ELFCLASS
+#define ELFCLASS	CONCAT(ELFCLASS,ELFSIZE)
+#endif
 
 #define	xe16toh(x)	((data == ELFDATA2MSB) ? be16toh(x) : le16toh(x))
 #define	xe32toh(x)	((data == ELFDATA2MSB) ? be32toh(x) : le32toh(x))
@@ -167,7 +170,7 @@ ELFNAMEEND(check)(int fd, const char *fn)
 	if (read(fd, &eh, sizeof eh) != sizeof eh)
 		return 0;
 
-	if (IS_ELF(eh) == 0)
+	if (IS_ELF(eh) == 0 || eh.e_ident[EI_CLASS] != ELFCLASS)
                 return 0;
 
 	data = eh.e_ident[EI_DATA];
@@ -179,33 +182,12 @@ ELFNAMEEND(check)(int fd, const char *fn)
 #define	EM_AARCH64	183
 #endif
 	case EM_AARCH64: break;
-#ifndef EM_ARM
-#define EM_ARM		40
-#endif
 	case EM_ARM: break;
-#ifndef EM_MIPS
-#define EM_MIPS		8
-#endif
-#ifndef EM_MIPS_RS4_BE		/* same as EM_MIPS_RS3_LE */
-#define EM_MIPS_RS4_BE	10
-#endif
 	case EM_MIPS: break;
 	case /* EM_MIPS_RS3_LE */ EM_MIPS_RS4_BE: break;
-#ifndef EM_PPC
-#define	EM_PPC		20
-#endif
 	case EM_PPC: break;
-#ifndef EM_PPC64
-#define	EM_PPC64	21
-#endif
 	case EM_PPC64: break;
-#ifndef EM_SPARCV9
-#define	EM_SPARCV9	43
-#endif
 	case EM_SPARCV9: break;
-#ifndef EM_X86_64
-#define	EM_X86_64	62
-#endif
 	case EM_X86_64: break;
 /*        ELFDEFNNAME(MACHDEP_ID_CASES) */
 
@@ -342,11 +324,14 @@ ELFNAMEEND(hide)(int fd, const char *fn)
 	 */
 
 	/* load section string table for debug use */
-	if ((shstrtabp = xmalloc(xewtoh(shstrtabshdr->sh_size), fn,
-	    "section string table")) == NULL)
+	if ((size = xewtoh(shstrtabshdr->sh_size)) == 0)
+		goto bad;
+	if ((shstrtabp = xmalloc(size, fn, "section string table")) == NULL)
 		goto bad;
 	if ((size_t)xreadatoff(fd, shstrtabp, xewtoh(shstrtabshdr->sh_offset),
-	    xewtoh(shstrtabshdr->sh_size), fn) != xewtoh(shstrtabshdr->sh_size))
+	    size, fn) != size)
+		goto bad;
+	if (shstrtabp[size - 1] != '\0')
 		goto bad;
 
 	/* we need symtab, strtab, and everything behind strtab */
@@ -367,7 +352,8 @@ ELFNAMEEND(hide)(int fd, const char *fn)
 			strtabidx = i;
 		if (layoutp[i].shdr == symtabshdr || i >= strtabidx) {
 			off = xewtoh(layoutp[i].shdr->sh_offset);
-			size = xewtoh(layoutp[i].shdr->sh_size);
+			if ((size = xewtoh(layoutp[i].shdr->sh_size)) == 0)
+				goto bad;
 			layoutp[i].bufp = xmalloc(size, fn,
 			    shstrtabp + xewtoh(layoutp[i].shdr->sh_name));
 			if (layoutp[i].bufp == NULL)
@@ -377,10 +363,13 @@ ELFNAMEEND(hide)(int fd, const char *fn)
 				goto bad;
 
 			/* set symbol table and string table */
-			if (layoutp[i].shdr == symtabshdr)
+			if (layoutp[i].shdr == symtabshdr) {
 				symtabp = layoutp[i].bufp;
-			else if (layoutp[i].shdr == strtabshdr)
+			} else if (layoutp[i].shdr == strtabshdr) {
 				strtabp = layoutp[i].bufp;
+				if (strtabp[size - 1] != '\0')
+					goto bad;
+			}
 		}
 	}
 
diff --git a/usr.sbin/crunch/crunchide/extern.h b/usr.sbin/crunch/crunchide/extern.h
index 4200bc3..1e7809a 100644
--- a/usr.sbin/crunch/crunchide/extern.h
+++ b/usr.sbin/crunch/crunchide/extern.h
@@ -31,14 +31,6 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifdef NLIST_AOUT
-int	check_aout(int, const char *);
-int	hide_aout(int, const char *);
-#endif
-#ifdef NLIST_ECOFF
-int	check_ecoff(int, const char *);
-int	hide_ecoff(int, const char *);
-#endif
 #ifdef NLIST_ELF32
 int	check_elf32(int, const char *);
 int	hide_elf32(int, const char *);
diff --git a/usr.sbin/ctld/ctl.conf.5 b/usr.sbin/ctld/ctl.conf.5
index ef21919..eb65fa1 100644
--- a/usr.sbin/ctld/ctl.conf.5
+++ b/usr.sbin/ctld/ctl.conf.5
@@ -27,7 +27,7 @@
 .\"
 .\" $FreeBSD$
 .\"
-.Dd March 4, 2015
+.Dd April 19, 2015
 .Dt CTL.CONF 5
 .Os
 .Sh NAME
@@ -365,7 +365,12 @@ All CTL-specific options are documented in the
 section of
 .Xr ctladm 8 .
 .It Ic path Ar path
-The path to the file or device node used to back the LUN.
+The path to the file, device node, or
+.Xr zfs 8
+volume used to back the LUN.
+For optimal performance, create the volume with the
+.Qq Ar volmode=dev
+property set.
 .It Ic serial Ar string
 The SCSI serial number presented to the initiator.
 .It Ic size Ar size
@@ -435,7 +440,8 @@ target naa.50015178f369f092 {
 .Sh SEE ALSO
 .Xr ctl 4 ,
 .Xr ctladm 8 ,
-.Xr ctld 8
+.Xr ctld 8 ,
+.Xr zfs 8
 .Sh AUTHORS
 The
 .Nm
diff --git a/usr.sbin/ctld/ctld.c b/usr.sbin/ctld/ctld.c
index 2f4f147..6f0c63b 100644
--- a/usr.sbin/ctld/ctld.c
+++ b/usr.sbin/ctld/ctld.c
@@ -203,7 +203,7 @@ auth_check_secret_length(struct auth *auth)
 	}
 
 	if (auth->a_mutual_secret != NULL) {
-		len = strlen(auth->a_secret);
+		len = strlen(auth->a_mutual_secret);
 		if (len > 16) {
 			if (auth->a_auth_group->ag_name != NULL)
 				log_warnx("mutual secret for user \"%s\", "
@@ -2399,8 +2399,11 @@ found:
 					client_fd = accept(portal->p_socket,
 					    (struct sockaddr *)&client_sa,
 					    &client_salen);
-					if (client_fd < 0)
+					if (client_fd < 0) {
+						if (errno == ECONNABORTED)
+							continue;
 						log_err(1, "accept");
+					}
 					assert(client_salen >= client_sa.ss_len);
 
 					handle_connection(portal, client_fd,
diff --git a/usr.sbin/ctld/discovery.c b/usr.sbin/ctld/discovery.c
index 15eaa76..d7d843e 100644
--- a/usr.sbin/ctld/discovery.c
+++ b/usr.sbin/ctld/discovery.c
@@ -32,7 +32,6 @@
 __FBSDID("$FreeBSD$");
 
 #include <assert.h>
-#include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
diff --git a/usr.sbin/ctld/isns.c b/usr.sbin/ctld/isns.c
index 11eef3e0..f7381a1 100644
--- a/usr.sbin/ctld/isns.c
+++ b/usr.sbin/ctld/isns.c
@@ -35,14 +35,8 @@ __FBSDID("$FreeBSD$");
 #include <sys/endian.h>
 #include <netinet/in.h>
 #include <arpa/inet.h>
-#include <assert.h>
-#include <ctype.h>
-#include <errno.h>
 #include <netdb.h>
-#include <signal.h>
 #include <stdbool.h>
-#include <stdio.h>
-#include <stdint.h>
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
diff --git a/usr.sbin/ctld/keys.c b/usr.sbin/ctld/keys.c
index c8f222d..f339a10 100644
--- a/usr.sbin/ctld/keys.c
+++ b/usr.sbin/ctld/keys.c
@@ -32,7 +32,6 @@
 __FBSDID("$FreeBSD$");
 
 #include <assert.h>
-#include <stdint.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
diff --git a/usr.sbin/ctld/login.c b/usr.sbin/ctld/login.c
index 9f9ef3c..c6b83d9 100644
--- a/usr.sbin/ctld/login.c
+++ b/usr.sbin/ctld/login.c
@@ -33,8 +33,6 @@ __FBSDID("$FreeBSD$");
 
 #include <assert.h>
 #include <stdbool.h>
-#include <stdint.h>
-#include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
@@ -802,9 +800,6 @@ login(struct connection *conn)
 	}
 	conn->conn_initiator_name = checked_strdup(initiator_name);
 	log_set_peer_name(conn->conn_initiator_name);
-	/*
-	 * XXX: This doesn't work (does nothing) because of Capsicum.
-	 */
 	setproctitle("%s (%s)", conn->conn_initiator_addr, conn->conn_initiator_name);
 
 	redirected = login_portal_redirect(conn, request);
diff --git a/usr.sbin/ctld/parse.y b/usr.sbin/ctld/parse.y
index 76873d4..cfc202c 100644
--- a/usr.sbin/ctld/parse.y
+++ b/usr.sbin/ctld/parse.y
@@ -35,7 +35,6 @@
 #include <sys/stat.h>
 #include <assert.h>
 #include <stdio.h>
-#include <stdint.h>
 #include <stdlib.h>
 #include <string.h>
 
diff --git a/usr.sbin/ctld/pdu.c b/usr.sbin/ctld/pdu.c
index c3181ac..be3598e 100644
--- a/usr.sbin/ctld/pdu.c
+++ b/usr.sbin/ctld/pdu.c
@@ -34,8 +34,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/types.h>
 #include <sys/uio.h>
 #include <assert.h>
-#include <stdint.h>
-#include <stdio.h>
 #include <stdlib.h>
 #include <unistd.h>
 
diff --git a/usr.sbin/ctld/token.l b/usr.sbin/ctld/token.l
index f0cb597..54b803b 100644
--- a/usr.sbin/ctld/token.l
+++ b/usr.sbin/ctld/token.l
@@ -34,7 +34,6 @@
 #include <stdint.h>
 #include <string.h>
 
-#include "ctld.h"
 #include "y.tab.h"
 
 int lineno;
diff --git a/usr.sbin/etcupdate/etcupdate.8 b/usr.sbin/etcupdate/etcupdate.8
index 1966179..c5a74f3 100644
--- a/usr.sbin/etcupdate/etcupdate.8
+++ b/usr.sbin/etcupdate/etcupdate.8
@@ -1,4 +1,4 @@
-.\" Copyright (c) 2010-2013 Advanced Computing Technologies LLC
+.\" Copyright (c) 2010-2013 Hudson River Trading LLC
 .\" Written by: John H. Baldwin <jhb@FreeBSD.org>
 .\" All rights reserved.
 .\"
diff --git a/usr.sbin/etcupdate/etcupdate.sh b/usr.sbin/etcupdate/etcupdate.sh
index a4728fa..6be57b6 100755
--- a/usr.sbin/etcupdate/etcupdate.sh
+++ b/usr.sbin/etcupdate/etcupdate.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2010-2013 Advanced Computing Technologies LLC
+# Copyright (c) 2010-2013 Hudson River Trading LLC
 # Written by: John H. Baldwin <jhb@FreeBSD.org>
 # All rights reserved.
 #
diff --git a/usr.sbin/etcupdate/tests/always_test.sh b/usr.sbin/etcupdate/tests/always_test.sh
index 514481e..2055bb6 100644
--- a/usr.sbin/etcupdate/tests/always_test.sh
+++ b/usr.sbin/etcupdate/tests/always_test.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2010 Advanced Computing Technologies LLC
+# Copyright (c) 2010 Hudson River Trading LLC
 # Written by: John H. Baldwin <jhb@FreeBSD.org>
 # All rights reserved.
 #
diff --git a/usr.sbin/etcupdate/tests/conflicts_test.sh b/usr.sbin/etcupdate/tests/conflicts_test.sh
index 816c180..71f16fa 100644
--- a/usr.sbin/etcupdate/tests/conflicts_test.sh
+++ b/usr.sbin/etcupdate/tests/conflicts_test.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2010 Advanced Computing Technologies LLC
+# Copyright (c) 2010 Hudson River Trading LLC
 # Written by: John H. Baldwin <jhb@FreeBSD.org>
 # All rights reserved.
 #
diff --git a/usr.sbin/etcupdate/tests/fbsdid_test.sh b/usr.sbin/etcupdate/tests/fbsdid_test.sh
index c062c06..d8d5cce 100644
--- a/usr.sbin/etcupdate/tests/fbsdid_test.sh
+++ b/usr.sbin/etcupdate/tests/fbsdid_test.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2010 Advanced Computing Technologies LLC
+# Copyright (c) 2010 Hudson River Trading LLC
 # Written by: John H. Baldwin <jhb@FreeBSD.org>
 # All rights reserved.
 #
diff --git a/usr.sbin/etcupdate/tests/ignore_test.sh b/usr.sbin/etcupdate/tests/ignore_test.sh
index 2d3d2f5..571dd24 100644
--- a/usr.sbin/etcupdate/tests/ignore_test.sh
+++ b/usr.sbin/etcupdate/tests/ignore_test.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2010 Advanced Computing Technologies LLC
+# Copyright (c) 2010 Hudson River Trading LLC
 # Written by: John H. Baldwin <jhb@FreeBSD.org>
 # All rights reserved.
 #
diff --git a/usr.sbin/etcupdate/tests/preworld_test.sh b/usr.sbin/etcupdate/tests/preworld_test.sh
index c731293..b724154 100644
--- a/usr.sbin/etcupdate/tests/preworld_test.sh
+++ b/usr.sbin/etcupdate/tests/preworld_test.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2013 Advanced Computing Technologies LLC
+# Copyright (c) 2013 Hudson River Trading LLC
 # Written by: John H. Baldwin <jhb@FreeBSD.org>
 # All rights reserved.
 #
diff --git a/usr.sbin/etcupdate/tests/tests_test.sh b/usr.sbin/etcupdate/tests/tests_test.sh
index b99bbef..5382de3 100644
--- a/usr.sbin/etcupdate/tests/tests_test.sh
+++ b/usr.sbin/etcupdate/tests/tests_test.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2010 Advanced Computing Technologies LLC
+# Copyright (c) 2010 Hudson River Trading LLC
 # Written by: John H. Baldwin <jhb@FreeBSD.org>
 # All rights reserved.
 #
diff --git a/usr.sbin/etcupdate/tests/tzsetup_test.sh b/usr.sbin/etcupdate/tests/tzsetup_test.sh
index b102938..dbdcc0e 100644
--- a/usr.sbin/etcupdate/tests/tzsetup_test.sh
+++ b/usr.sbin/etcupdate/tests/tzsetup_test.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 #
-# Copyright (c) 2013 Advanced Computing Technologies LLC
+# Copyright (c) 2013 Hudson River Trading LLC
 # Written by: John H. Baldwin <jhb@FreeBSD.org>
 # All rights reserved.
 #
diff --git a/usr.sbin/fifolog/fifolog_reader/Makefile b/usr.sbin/fifolog/fifolog_reader/Makefile
index 19ce281..ae5f9e7 100644
--- a/usr.sbin/fifolog/fifolog_reader/Makefile
+++ b/usr.sbin/fifolog/fifolog_reader/Makefile
@@ -6,7 +6,7 @@ CFLAGS+= -I${.CURDIR}/../lib
 
 MAN=
 
-LIBADD=	z fifolog
+LIBADD=	fifolog
 
 regress:
 	./${PROG} /tmp/fifolog.0
diff --git a/usr.sbin/fifolog/fifolog_writer/Makefile b/usr.sbin/fifolog/fifolog_writer/Makefile
index 3e5e6cc..7a9316d 100644
--- a/usr.sbin/fifolog/fifolog_writer/Makefile
+++ b/usr.sbin/fifolog/fifolog_writer/Makefile
@@ -6,7 +6,7 @@ CFLAGS+= -I${.CURDIR}/../lib
 
 MAN=
 
-LIBADD=	z fifolog
+LIBADD=	fifolog
 
 regress:
 	date | ./${PROG} -z 0 /tmp/fifolog.0
diff --git a/usr.sbin/freebsd-update/freebsd-update.sh b/usr.sbin/freebsd-update/freebsd-update.sh
index 2434929..fda1d90 100644
--- a/usr.sbin/freebsd-update/freebsd-update.sh
+++ b/usr.sbin/freebsd-update/freebsd-update.sh
@@ -690,7 +690,7 @@ fetch_check_params () {
 	fi
 
 	# Check that we have updates ready to install
-	if [ -f ${BDHASH}-install/kerneldone && $FORCEFETCH -eq 0 ]; then
+	if [ -f ${BDHASH}-install/kerneldone -a $FORCEFETCH -eq 0 ]; then
 		echo "You have a partially completed upgrade pending"
 		echo "Run '$0 install' first."
 		echo "Run '$0 fetch -F' to proceed anyway."
@@ -3220,7 +3220,7 @@ get_params () {
 # Fetch command.  Make sure that we're being called
 # interactively, then run fetch_check_params and fetch_run
 cmd_fetch () {
-	if [ ! -t 0 && $NOTTYOK -eq 0 ]; then
+	if [ ! -t 0 -a $NOTTYOK -eq 0 ]; then
 		echo -n "`basename $0` fetch should not "
 		echo "be run non-interactively."
 		echo "Run `basename $0` cron instead."
diff --git a/usr.sbin/ifmcstat/ifmcstat.c b/usr.sbin/ifmcstat/ifmcstat.c
index d3798e3..4f3f444 100644
--- a/usr.sbin/ifmcstat/ifmcstat.c
+++ b/usr.sbin/ifmcstat/ifmcstat.c
@@ -41,7 +41,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/tree.h>
 
 #include <net/if.h>
-#include <net/if_var.h>
 #include <net/if_types.h>
 #include <net/if_dl.h>
 #include <net/route.h>
diff --git a/usr.sbin/inetd/inetd.c b/usr.sbin/inetd/inetd.c
index c48f33c..178cb58 100644
--- a/usr.sbin/inetd/inetd.c
+++ b/usr.sbin/inetd/inetd.c
@@ -1752,10 +1752,10 @@ more:
                 memmove(sep->se_proto, sep->se_proto + 4,
                     strlen(sep->se_proto) + 1 - 4);
                 sep->se_rpc = 1;
-                sep->se_rpc_prog = sep->se_rpc_lowvers =
-			sep->se_rpc_lowvers = 0;
 		memcpy(&sep->se_ctrladdr4, bind_sa4,
-		       sizeof(sep->se_ctrladdr4));
+			sizeof(sep->se_ctrladdr4));
+                sep->se_rpc_prog = sep->se_rpc_lowvers =
+			sep->se_rpc_highvers = 0;
                 if ((versp = strrchr(sep->se_service, '/'))) {
                         *versp++ = '\0';
                         switch (sscanf(versp, "%u-%u",
diff --git a/usr.sbin/iovctl/iovctl.c b/usr.sbin/iovctl/iovctl.c
index faa9586..dbf29d8 100644
--- a/usr.sbin/iovctl/iovctl.c
+++ b/usr.sbin/iovctl/iovctl.c
@@ -80,7 +80,7 @@ get_schema(int fd)
 		err(1, "Could not fetch config schema");
 	}
 
-	schema = nvlist_unpack(arg.schema, arg.len);
+	schema = nvlist_unpack(arg.schema, arg.len, NV_FLAG_IGNORE_CASE);
 	if (schema == NULL)
 		err(1, "Could not unpack schema");
 
diff --git a/usr.sbin/iovctl/iovctl.conf.5 b/usr.sbin/iovctl/iovctl.conf.5
index b46a409..f7a6052 100644
--- a/usr.sbin/iovctl/iovctl.conf.5
+++ b/usr.sbin/iovctl/iovctl.conf.5
@@ -144,7 +144,7 @@ passthrough devices through the use of the default section.
 VF-0 is not configured as a passthrough device as it explicitly overrides the
 default.
 VF-0 also sets a device-specific parameter named mac-addr.
-.Bd -literal .offset ident
+.Bd -literal -offset ident
 PF {
 	device : "ix0";
 	num_vfs : 3;
@@ -160,8 +160,8 @@ VF-0 {
 }
 .Ed
 .Sh SEE ALSO
-.Xr iovctl 8 ,
-.Xr rc.conf 5
+.Xr rc.conf 5 ,
+.Xr iovctl 8
 .Sh AUTHORS
 This manual page was written by
 .An Ryan Stone Aq Mt rstone@FreeBSD.org .
diff --git a/usr.sbin/ip6addrctl/ip6addrctl.c b/usr.sbin/ip6addrctl/ip6addrctl.c
index 6a730ff..d9bf89d 100644
--- a/usr.sbin/ip6addrctl/ip6addrctl.c
+++ b/usr.sbin/ip6addrctl/ip6addrctl.c
@@ -39,7 +39,6 @@
 #include <sys/sysctl.h>
 
 #include <net/if.h>
-#include <net/if_var.h>
 
 #include <netinet/in.h>
 #include <netinet6/in6_var.h>
diff --git a/usr.sbin/jail/jail.8 b/usr.sbin/jail/jail.8
index 8952ae3..189fa36 100644
--- a/usr.sbin/jail/jail.8
+++ b/usr.sbin/jail/jail.8
@@ -1221,7 +1221,6 @@ environment of the first jail.
 .Xr jls 8 ,
 .Xr mount 8 ,
 .Xr named 8 ,
-.Xr procfs 5 ,
 .Xr reboot 8 ,
 .Xr rpcbind 8 ,
 .Xr sendmail 8 ,
diff --git a/usr.sbin/mld6query/mld6.c b/usr.sbin/mld6query/mld6.c
index 53f38ae..a3c8342 100644
--- a/usr.sbin/mld6query/mld6.c
+++ b/usr.sbin/mld6query/mld6.c
@@ -42,7 +42,6 @@ __FBSDID("$FreeBSD$");
 #include <signal.h>
 
 #include <net/if.h>
-#include <net/if_var.h>
 
 #include <netinet/in.h>
 #include <netinet/ip6.h>
diff --git a/usr.sbin/mountd/mountd.8 b/usr.sbin/mountd/mountd.8
index fe73743..4dbf5ff 100644
--- a/usr.sbin/mountd/mountd.8
+++ b/usr.sbin/mountd/mountd.8
@@ -38,7 +38,7 @@
 mount requests
 .Sh SYNOPSIS
 .Nm
-.Op Fl 2delnorS
+.Op Fl 2delnrS
 .Op Fl h Ar bindip
 .Op Fl p Ar port
 .Op Ar exportsfile ...
@@ -69,8 +69,7 @@ Output debugging information.
 will not detach from the controlling terminal and will print
 debugging messages to stderr.
 .It Fl e
-The new NFS server that includes NFSv4 support is now the default, so this
-option is now a no-op and should be considered deprecated.
+Ignored; included for backward compatibility.
 .It Fl h Ar bindip
 Specify specific IP addresses to bind to for TCP and UDP requests.
 This option may be specified multiple times.
@@ -98,9 +97,6 @@ This should only be specified if there are clients such as PC's,
 that require it.
 It will automatically clear the vfs.nfsrv.nfs_privport sysctl flag, which
 controls if the kernel will accept NFS requests from reserved ports only.
-.It Fl o
-This flag forces the system to run the old NFS server, which does not
-have NFSv4 support in it.
 .It Fl p Ar port
 Force
 .Nm
diff --git a/usr.sbin/mountd/mountd.c b/usr.sbin/mountd/mountd.c
index ad1964e..3508f50 100644
--- a/usr.sbin/mountd/mountd.c
+++ b/usr.sbin/mountd/mountd.c
@@ -253,7 +253,6 @@ static int have_v6 = 1;
 
 int v4root_phase = 0;
 char v4root_dirpath[PATH_MAX + 1];
-int run_v4server = 1;
 int has_publicfh = 0;
 
 struct pidfh *pfh = NULL;
@@ -312,7 +311,7 @@ main(int argc, char **argv)
 	else
 		close(s);
 
-	while ((c = getopt(argc, argv, "2deh:lnop:rS")) != -1)
+	while ((c = getopt(argc, argv, "2deh:lnp:rS")) != -1)
 		switch (c) {
 		case '2':
 			force_v2 = 1;
@@ -332,9 +331,6 @@ main(int argc, char **argv)
 		case 'l':
 			dolog = 1;
 			break;
-		case 'o':
-			run_v4server = 0;
-			break;
 		case 'p':
 			endptr = NULL;
 			svcport = (in_port_t)strtoul(optarg, &endptr, 10);
@@ -371,19 +367,9 @@ main(int argc, char **argv)
 			usage();
 		};
 
-	/*
-	 * Unless the "-o" option was specified, try and run "nfsd".
-	 * If "-o" was specified, try and run "nfsserver".
-	 */
-	if (run_v4server > 0) {
-		if (modfind("nfsd") < 0) {
-			/* Not present in kernel, try loading it */
-			if (kldload("nfsd") < 0 || modfind("nfsd") < 0)
-				errx(1, "NFS server is not available");
-		}
-	} else if (modfind("nfsserver") < 0) {
+	if (modfind("nfsd") < 0) {
 		/* Not present in kernel, try loading it */
-		if (kldload("nfsserver") < 0 || modfind("nfsserver") < 0)
+		if (kldload("nfsd") < 0 || modfind("nfsd") < 0)
 			errx(1, "NFS server is not available");
 	}
 
@@ -1697,8 +1683,7 @@ get_exportlist(void)
 	 */
 	bzero(&eargs, sizeof (eargs));
 	eargs.export.ex_flags = MNT_DELEXPORT;
-	if (run_v4server > 0 &&
-	    nfssvc(NFSSVC_V4ROOTEXPORT, (caddr_t)&eargs) < 0 &&
+	if (nfssvc(NFSSVC_V4ROOTEXPORT, (caddr_t)&eargs) < 0 &&
 	    errno != ENOENT)
 		syslog(LOG_ERR, "Can't delete exports for V4:");
 
@@ -1732,6 +1717,12 @@ get_exportlist(void)
 		}
 
 		/*
+		 * We do not need to delete "export" flag from
+		 * filesystems that do not have it set.
+		 */
+		if (!(fsp->f_flags & MNT_EXPORTED))
+		    continue;
+		/*
 		 * Do not delete export for network filesystem by
 		 * passing "export" arg to nmount().
 		 * It only makes sense to do this for local filesystems.
@@ -1797,7 +1788,7 @@ get_exportlist(void)
 	/*
 	 * If there was no public fh, clear any previous one set.
 	 */
-	if (run_v4server > 0 && has_publicfh == 0)
+	if (has_publicfh == 0)
 		(void) nfssvc(NFSSVC_NOPUBLICFH, NULL);
 
 	/* Resume the nfsd. If they weren't suspended, this is harmless. */
@@ -2394,7 +2385,7 @@ do_mount(struct exportlist *ep, struct grouplist *grp, int exflags,
 {
 	struct statfs fsb1;
 	struct addrinfo *ai;
-	struct export_args ea, *eap;
+	struct export_args *eap;
 	char errmsg[255];
 	char *cp;
 	int done;
@@ -2404,10 +2395,7 @@ do_mount(struct exportlist *ep, struct grouplist *grp, int exflags,
 	int ret;
 	struct nfsex_args nfsea;
 
-	if (run_v4server > 0)
-		eap = &nfsea.export;
-	else
-		eap = &ea;
+	eap = &nfsea.export;
 
 	cp = NULL;
 	savedc = '\0';
@@ -2487,8 +2475,7 @@ do_mount(struct exportlist *ep, struct grouplist *grp, int exflags,
 		 */
 		if (v4root_phase == 2) {
 			nfsea.fspec = v4root_dirpath;
-			if (run_v4server > 0 &&
-			    nfssvc(NFSSVC_V4ROOTEXPORT, (caddr_t)&nfsea) < 0) {
+			if (nfssvc(NFSSVC_V4ROOTEXPORT, (caddr_t)&nfsea) < 0) {
 				syslog(LOG_ERR, "Exporting V4: failed");
 				return (2);
 			}
@@ -2577,7 +2564,7 @@ do_mount(struct exportlist *ep, struct grouplist *grp, int exflags,
 		 * If this is the public directory, get the file handle
 		 * and load it into the kernel via the nfssvc() syscall.
 		 */
-		if (run_v4server > 0 && (exflags & MNT_EXPUBLIC) != 0) {
+		if ((exflags & MNT_EXPUBLIC) != 0) {
 			fhandle_t fh;
 			char *public_name;
 
diff --git a/usr.sbin/ndp/ndp.c b/usr.sbin/ndp/ndp.c
index e896010..339a4b6 100644
--- a/usr.sbin/ndp/ndp.c
+++ b/usr.sbin/ndp/ndp.c
@@ -83,7 +83,6 @@
 #include <sys/queue.h>
 
 #include <net/if.h>
-#include <net/if_var.h>
 #include <net/if_dl.h>
 #include <net/if_types.h>
 #include <net/route.h>
diff --git a/usr.sbin/nfsd/nfsd.8 b/usr.sbin/nfsd/nfsd.8
index 157fc52..d014a01 100644
--- a/usr.sbin/nfsd/nfsd.8
+++ b/usr.sbin/nfsd/nfsd.8
@@ -28,7 +28,7 @@
 .\"	@(#)nfsd.8	8.4 (Berkeley) 3/29/95
 .\" $FreeBSD$
 .\"
-.Dd January 1, 2015
+.Dd April 25, 2015
 .Dt NFSD 8
 .Os
 .Sh NAME
@@ -38,7 +38,7 @@
 server
 .Sh SYNOPSIS
 .Nm
-.Op Fl arduteo
+.Op Fl ardute
 .Op Fl n Ar num_servers
 .Op Fl h Ar bindip
 .Op Fl Fl maxthreads Ar max_threads
@@ -112,11 +112,7 @@ Serve
 .Tn UDP NFS
 clients.
 .It Fl e
-The new NFS server that includes NFSv4 support is now the default, so this
-option is now a no-op and should be considered deprecated.
-.It Fl o
-Forces the use of the old NFS server that does not include NFSv4 support
-in it.
+Ignored; included for backward compatibility.
 .El
 .Pp
 For example,
diff --git a/usr.sbin/nfsd/nfsd.c b/usr.sbin/nfsd/nfsd.c
index b114ba6..f58ed30 100644
--- a/usr.sbin/nfsd/nfsd.c
+++ b/usr.sbin/nfsd/nfsd.c
@@ -87,8 +87,6 @@ static int nfsdcnt;		/* number of children */
 static int nfsdcnt_set;
 static int minthreads;
 static int maxthreads;
-static int new_syscall;
-static int run_v4server = 1;	/* Force running of nfsv4 server */
 static int nfssvc_nfsd;		/* Set to correct NFSSVC_xxx flag */
 static int stablefd = -1;	/* Fd for the stable restart file */
 static int backupfd;		/* Fd for the backup stable restart file */
@@ -156,7 +154,7 @@ main(int argc, char **argv)
 	socklen_t len;
 	int on = 1, unregister, reregister, sock;
 	int tcp6sock, ip6flag, tcpflag, tcpsock;
-	int udpflag, ecode, error, s, srvcnt;
+	int udpflag, ecode, error, s;
 	int bindhostc, bindanyflag, rpcbreg, rpcbregcnt;
 	int nfssvc_addsock;
 	int longindex = 0;
@@ -167,10 +165,10 @@ main(int argc, char **argv)
 	nfsdcnt = DEFNFSDCNT;
 	unregister = reregister = tcpflag = maxsock = 0;
 	bindanyflag = udpflag = connect_type_cnt = bindhostc = 0;
-	getopt_shortopts = "ah:n:rdtueo";
+	getopt_shortopts = "ah:n:rdtue";
 	getopt_usage =
 	    "usage:\n"
-	    "  nfsd [-ardtueo] [-h bindip]\n"
+	    "  nfsd [-ardtue] [-h bindip]\n"
 	    "       [-n numservers] [--minthreads #] [--maxthreads #]\n";
 	while ((ch = getopt_long(argc, argv, getopt_shortopts, longopts,
 		    &longindex)) != -1)
@@ -205,9 +203,6 @@ main(int argc, char **argv)
 		case 'e':
 			/* now a no-op, since this is the default */
 			break;
-		case 'o':
-			run_v4server = 0;
-			break;
 		case 0:
 			lopt = longopts[longindex].name;
 			if (!strcmp(lopt, "minthreads")) {
@@ -242,15 +237,9 @@ main(int argc, char **argv)
 	 * Unless the "-o" option was specified, try and run "nfsd".
 	 * If "-o" was specified, try and run "nfsserver".
 	 */
-	if (run_v4server > 0) {
-		if (modfind("nfsd") < 0) {
-			/* Not present in kernel, try loading it */
-			if (kldload("nfsd") < 0 || modfind("nfsd") < 0)
-				errx(1, "NFS server is not available");
-		}
-	} else if (modfind("nfsserver") < 0) {
+	if (modfind("nfsd") < 0) {
 		/* Not present in kernel, try loading it */
-		if (kldload("nfsserver") < 0 || modfind("nfsserver") < 0)
+		if (kldload("nfsd") < 0 || modfind("nfsd") < 0)
 			errx(1, "NFS server is not available");
 	}
 
@@ -392,55 +381,21 @@ main(int argc, char **argv)
 	 * level write-back caching. (See SCSI doc for more information
 	 * on how to prevent write-back caching on SCSI disks.)
 	 */
-	if (run_v4server > 0) {
-		open_stable(&stablefd, &backupfd);
-		if (stablefd < 0) {
-			syslog(LOG_ERR, "Can't open %s: %m\n", NFSD_STABLERESTART);
-			exit(1);
-		}
-		/* This system call will fail for old kernels, but that's ok. */
-		nfssvc(NFSSVC_BACKUPSTABLE, NULL);
-		if (nfssvc(NFSSVC_STABLERESTART, (caddr_t)&stablefd) < 0) {
-			syslog(LOG_ERR, "Can't read stable storage file: %m\n");
-			exit(1);
-		}
-		nfssvc_addsock = NFSSVC_NFSDADDSOCK;
-		nfssvc_nfsd = NFSSVC_NFSDNFSD;
-		new_syscall = TRUE;
-	} else {
-		nfssvc_addsock = NFSSVC_ADDSOCK;
-		nfssvc_nfsd = NFSSVC_NFSD;
-		/*
-		 * Figure out if the kernel supports the new-style
-		 * NFSSVC_NFSD. Old kernels will return ENXIO because they
-		 * don't recognise the flag value, new ones will return EINVAL
-		 * because argp is NULL.
-		 */
-		new_syscall = FALSE;
-		if (nfssvc(NFSSVC_NFSD, NULL) < 0 && errno == EINVAL)
-			new_syscall = TRUE;
+	open_stable(&stablefd, &backupfd);
+	if (stablefd < 0) {
+		syslog(LOG_ERR, "Can't open %s: %m\n", NFSD_STABLERESTART);
+		exit(1);
 	}
+	/* This system call will fail for old kernels, but that's ok. */
+	nfssvc(NFSSVC_BACKUPSTABLE, NULL);
+	if (nfssvc(NFSSVC_STABLERESTART, (caddr_t)&stablefd) < 0) {
+		syslog(LOG_ERR, "Can't read stable storage file: %m\n");
+		exit(1);
+	}
+	nfssvc_addsock = NFSSVC_NFSDADDSOCK;
+	nfssvc_nfsd = NFSSVC_NFSDNFSD;
 
-	if (!new_syscall) {
-		/* If we use UDP only, we start the last server below. */
-		srvcnt = tcpflag ? nfsdcnt : nfsdcnt - 1;
-		for (i = 0; i < srvcnt; i++) {
-			switch ((pid = fork())) {
-			case -1:
-				syslog(LOG_ERR, "fork: %m");
-				nfsd_exit(1);
-			case 0:
-				break;
-			default:
-				children[i] = pid;
-				continue;
-			}
-			(void)signal(SIGUSR1, child_cleanup);
-			setproctitle("server");
-
-			start_server(0);
-		}
-	} else if (tcpflag) {
+	if (tcpflag) {
 		/*
 		 * For TCP mode, we fork once to start the first
 		 * kernel nfsd thread. The kernel will add more
@@ -626,7 +581,7 @@ main(int argc, char **argv)
 					    bindhost[i]);
 					nfsd_exit(1);
 				}
-				if (listen(tcpsock, 5) < 0) {
+				if (listen(tcpsock, -1) < 0) {
 					syslog(LOG_ERR, "listen failed");
 					nfsd_exit(1);
 				}
@@ -701,7 +656,7 @@ main(int argc, char **argv)
 					    bindhost[i]);
 					nfsd_exit(1);
 				}
-				if (listen(tcp6sock, 5) < 0) {
+				if (listen(tcp6sock, -1) < 0) {
 					syslog(LOG_ERR, "listen failed");
 					nfsd_exit(1);
 				}
@@ -976,11 +931,6 @@ get_tuned_nfsdcount(void)
 	} else {
 		tuned_nfsdcnt = ncpu * 8;
 	}
-	if (!new_syscall && tuned_nfsdcnt > MAXNFSDCNT) {
-		warnx("nfsd count %d; truncated to %d", tuned_nfsdcnt,
-		    MAXNFSDCNT);
-		tuned_nfsdcnt = MAXNFSDCNT;
-	}
 	return tuned_nfsdcnt;
 }
 
@@ -994,55 +944,48 @@ start_server(int master)
 	struct addrinfo *aip, hints;
 
 	status = 0;
-	if (new_syscall) {
-		gethostname(hostname, sizeof (hostname));
-		snprintf(principal, sizeof (principal), "nfs@%s", hostname);
-		if ((cp = strchr(hostname, '.')) == NULL ||
-		    *(cp + 1) == '\0') {
-			/* If not fully qualified, try getaddrinfo() */
-			memset((void *)&hints, 0, sizeof (hints));
-			hints.ai_flags = AI_CANONNAME;
-			error = getaddrinfo(hostname, NULL, &hints, &aip);
-			if (error == 0) {
-				if (aip->ai_canonname != NULL &&
-				    (cp = strchr(aip->ai_canonname, '.')) !=
-				    NULL && *(cp + 1) != '\0')
-					snprintf(principal, sizeof (principal),
-					    "nfs@%s", aip->ai_canonname);
-				freeaddrinfo(aip);
-			}
+	gethostname(hostname, sizeof (hostname));
+	snprintf(principal, sizeof (principal), "nfs@%s", hostname);
+	if ((cp = strchr(hostname, '.')) == NULL ||
+	    *(cp + 1) == '\0') {
+		/* If not fully qualified, try getaddrinfo() */
+		memset((void *)&hints, 0, sizeof (hints));
+		hints.ai_flags = AI_CANONNAME;
+		error = getaddrinfo(hostname, NULL, &hints, &aip);
+		if (error == 0) {
+			if (aip->ai_canonname != NULL &&
+			    (cp = strchr(aip->ai_canonname, '.')) !=
+			    NULL && *(cp + 1) != '\0')
+				snprintf(principal, sizeof (principal),
+				    "nfs@%s", aip->ai_canonname);
+			freeaddrinfo(aip);
 		}
-		nfsdargs.principal = principal;
+	}
+	nfsdargs.principal = principal;
 
-		if (nfsdcnt_set)
-			nfsdargs.minthreads = nfsdargs.maxthreads = nfsdcnt;
-		else {
-			nfsdargs.minthreads = minthreads_set ? minthreads : get_tuned_nfsdcount();
-			nfsdargs.maxthreads = maxthreads_set ? maxthreads : nfsdargs.minthreads;
-			if (nfsdargs.maxthreads < nfsdargs.minthreads)
-				nfsdargs.maxthreads = nfsdargs.minthreads;
-		}
+	if (nfsdcnt_set)
+		nfsdargs.minthreads = nfsdargs.maxthreads = nfsdcnt;
+	else {
+		nfsdargs.minthreads = minthreads_set ? minthreads : get_tuned_nfsdcount();
+		nfsdargs.maxthreads = maxthreads_set ? maxthreads : nfsdargs.minthreads;
+		if (nfsdargs.maxthreads < nfsdargs.minthreads)
+			nfsdargs.maxthreads = nfsdargs.minthreads;
+	}
+	error = nfssvc(nfssvc_nfsd, &nfsdargs);
+	if (error < 0 && errno == EAUTH) {
+		/*
+		 * This indicates that it could not register the
+		 * rpcsec_gss credentials, usually because the
+		 * gssd daemon isn't running.
+		 * (only the experimental server with nfsv4)
+		 */
+		syslog(LOG_ERR, "No gssd, using AUTH_SYS only");
+		principal[0] = '\0';
 		error = nfssvc(nfssvc_nfsd, &nfsdargs);
-		if (error < 0 && errno == EAUTH) {
-			/*
-			 * This indicates that it could not register the
-			 * rpcsec_gss credentials, usually because the
-			 * gssd daemon isn't running.
-			 * (only the experimental server with nfsv4)
-			 */
-			syslog(LOG_ERR, "No gssd, using AUTH_SYS only");
-			principal[0] = '\0';
-			error = nfssvc(nfssvc_nfsd, &nfsdargs);
-		}
-		if (error < 0) {
-			syslog(LOG_ERR, "nfssvc: %m");
-			status = 1;
-		}
-	} else {
-		if (nfssvc(NFSSVC_OLDNFSD, NULL) < 0) {
-			syslog(LOG_ERR, "nfssvc: %m");
-			status = 1;
-		}
+	}
+	if (error < 0) {
+		syslog(LOG_ERR, "nfssvc: %m");
+		status = 1;
 	}
 	if (master)
 		nfsd_exit(status);
diff --git a/usr.sbin/ntp/config.h b/usr.sbin/ntp/config.h
index 6c49557..b771834 100644
--- a/usr.sbin/ntp/config.h
+++ b/usr.sbin/ntp/config.h
@@ -613,9 +613,6 @@
 /* Define to 1 if you have the <net/if.h> header file. */
 #define HAVE_NET_IF_H 1
 
-/* Define to 1 if you have the <net/if_var.h> header file. */
-#define HAVE_NET_IF_VAR_H 1
-
 /* Define to 1 if you have the <net/route.h> header file. */
 #define HAVE_NET_ROUTE_H 1
 
diff --git a/usr.sbin/ntp/doc/ntptime.8 b/usr.sbin/ntp/doc/ntptime.8
index f130307..bb3b41a 100644
--- a/usr.sbin/ntp/doc/ntptime.8
+++ b/usr.sbin/ntp/doc/ntptime.8
@@ -1,7 +1,7 @@
 .\"
 .\" $FreeBSD$
 .\"
-.Dd January 7, 2000
+.Dd April 27, 2015
 .Dt NTPTIME 8
 .Os
 .Sh NAME
@@ -52,8 +52,6 @@ Specify estimated error, in microseconds.
 Specify frequency offset, in parts per million.
 .It Fl h
 Display help information.
-.It Fl l
-Specify the leap bits as a code from 0 to 3.
 .It Fl m Ar max_error
 Specify max possible errors, in microseconds.
 .It Fl o Ar offset
diff --git a/usr.sbin/pciconf/err.c b/usr.sbin/pciconf/err.c
index b67d1f5..7a77903 100644
--- a/usr.sbin/pciconf/err.c
+++ b/usr.sbin/pciconf/err.c
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 2012 Advanced Computing Technologies LLC
+ * Copyright (c) 2012 Hudson River Trading LLC
  * Written by: John H. Baldwin <jhb@FreeBSD.org>
  * All rights reserved.
  *
diff --git a/usr.sbin/ppp/iface.c b/usr.sbin/ppp/iface.c
index 8fee189..5f17769 100644
--- a/usr.sbin/ppp/iface.c
+++ b/usr.sbin/ppp/iface.c
@@ -31,9 +31,6 @@
 #include <netinet/in.h>
 #include <net/if.h>
 #include <net/if_dl.h>
-#ifdef __FreeBSD__
-#include <net/if_var.h>
-#endif
 #include <net/route.h>
 #include <netinet/in_systm.h>
 #include <netinet/in_var.h>
diff --git a/usr.sbin/rip6query/rip6query.c b/usr.sbin/rip6query/rip6query.c
index ea448ba2..a35c750 100644
--- a/usr.sbin/rip6query/rip6query.c
+++ b/usr.sbin/rip6query/rip6query.c
@@ -46,9 +46,6 @@
 #include <sys/queue.h>
 
 #include <net/if.h>
-#if defined(__FreeBSD__) && __FreeBSD__ >= 3
-#include <net/if_var.h>
-#endif /* __FreeBSD__ >= 3 */
 #include <netinet/in.h>
 #include <netinet/in_var.h>
 #include <arpa/inet.h>
diff --git a/usr.sbin/route6d/route6d.c b/usr.sbin/route6d/route6d.c
index 258219b..3c3d9d3 100644
--- a/usr.sbin/route6d/route6d.c
+++ b/usr.sbin/route6d/route6d.c
@@ -63,7 +63,6 @@ static const char _rcsid[] = "$KAME: route6d.c,v 1.104 2003/10/31 00:30:20 itoju
 #include <sys/sysctl.h>
 #include <sys/uio.h>
 #include <net/if.h>
-#include <net/if_var.h>
 #include <net/route.h>
 #include <netinet/in.h>
 #include <netinet/in_var.h>
diff --git a/usr.sbin/rpc.lockd/Makefile b/usr.sbin/rpc.lockd/Makefile
index 16b4d4f..73c69ef 100644
--- a/usr.sbin/rpc.lockd/Makefile
+++ b/usr.sbin/rpc.lockd/Makefile
@@ -9,7 +9,7 @@ SRCS=	kern.c nlm_prot_svc.c lockd.c lock_proc.c lockd_lock.c
 CFLAGS+= -I. -I${DESTDIR}/usr/include/rpcsvc
 WARNS?= 3
 
-LIBADD=	rpcsvc util
+LIBADD=	rpcsvc
 
 CLEANFILES= nlm_prot_svc.c nlm_prot.h test
 
diff --git a/usr.sbin/rrenumd/lexer.l b/usr.sbin/rrenumd/lexer.l
index 6e55f9e..47656e8 100644
--- a/usr.sbin/rrenumd/lexer.l
+++ b/usr.sbin/rrenumd/lexer.l
@@ -40,10 +40,6 @@
 #include <string.h>
 
 #include <net/if.h>
-#if defined(__FreeBSD__) && __FreeBSD__ >= 3
-#include <net/if_var.h>
-#endif /* __FreeBSD__ >= 3 */
-
 #include <netinet/in.h>
 #include <netinet/in_var.h>
 #include <netinet/icmp6.h>
diff --git a/usr.sbin/rrenumd/parser.y b/usr.sbin/rrenumd/parser.y
index 65dfd46..6436df7 100644
--- a/usr.sbin/rrenumd/parser.y
+++ b/usr.sbin/rrenumd/parser.y
@@ -39,9 +39,6 @@
 #include <sys/queue.h>
 
 #include <net/if.h>
-#if defined(__FreeBSD__) && __FreeBSD__ >= 3
-#include <net/if_var.h>
-#endif /* __FreeBSD__ >= 3 */
 
 #include <netinet/in.h>
 #include <netinet/in_var.h>
diff --git a/usr.sbin/rtadvctl/rtadvctl.c b/usr.sbin/rtadvctl/rtadvctl.c
index 3f22518..f1657d7 100644
--- a/usr.sbin/rtadvctl/rtadvctl.c
+++ b/usr.sbin/rtadvctl/rtadvctl.c
@@ -36,7 +36,6 @@
 #include <net/if.h>
 #include <net/if_dl.h>
 #include <net/if_types.h>
-#include <net/if_var.h>
 #include <net/ethernet.h>
 #include <netinet/in.h>
 #include <netinet/ip6.h>
diff --git a/usr.sbin/rtadvd/config.c b/usr.sbin/rtadvd/config.c
index 5c9d778..4f14e0fb 100644
--- a/usr.sbin/rtadvd/config.c
+++ b/usr.sbin/rtadvd/config.c
@@ -36,7 +36,6 @@
 #include <sys/socket.h>
 
 #include <net/if.h>
-#include <net/if_var.h>
 #include <net/route.h>
 #include <net/if_dl.h>
 
diff --git a/usr.sbin/rtadvd/if.c b/usr.sbin/rtadvd/if.c
index 5413cdf..0eef734 100644
--- a/usr.sbin/rtadvd/if.c
+++ b/usr.sbin/rtadvd/if.c
@@ -38,7 +38,6 @@
 #include <net/if.h>
 #include <net/if_dl.h>
 #include <net/if_types.h>
-#include <net/if_var.h>
 #include <net/ethernet.h>
 #include <net/route.h>
 #include <netinet/in.h>
diff --git a/usr.sbin/rtadvd/rrenum.c b/usr.sbin/rtadvd/rrenum.c
index 0c97d98..eede4b6 100644
--- a/usr.sbin/rtadvd/rrenum.c
+++ b/usr.sbin/rtadvd/rrenum.c
@@ -37,7 +37,6 @@
 
 #include <net/if.h>
 #include <net/if_dl.h>
-#include <net/if_var.h>
 #include <net/route.h>
 #include <netinet/in.h>
 #include <netinet/in_var.h>
diff --git a/usr.sbin/rtadvd/rtadvd.c b/usr.sbin/rtadvd/rtadvd.c
index 6554b61..0169a56 100644
--- a/usr.sbin/rtadvd/rtadvd.c
+++ b/usr.sbin/rtadvd/rtadvd.c
@@ -51,7 +51,6 @@
 
 #include <arpa/inet.h>
 
-#include <net/if_var.h>
 #include <netinet/in_var.h>
 #include <netinet6/nd6.h>
 
diff --git a/usr.sbin/rtsold/Makefile b/usr.sbin/rtsold/Makefile
index 53dea03..a235dfb 100644
--- a/usr.sbin/rtsold/Makefile
+++ b/usr.sbin/rtsold/Makefile
@@ -21,6 +21,5 @@ SRCS=	rtsold.c rtsol.c if.c probe.c dump.c rtsock.c
 
 WARNS?=	3
 CFLAGS+= -DHAVE_ARC4RANDOM -DHAVE_POLL_H
-LIBADD=	kvm
 
 .include <bsd.prog.mk>
diff --git a/usr.sbin/rtsold/if.c b/usr.sbin/rtsold/if.c
index 2bf946d..b8a90b6 100644
--- a/usr.sbin/rtsold/if.c
+++ b/usr.sbin/rtsold/if.c
@@ -38,7 +38,6 @@
 #include <sys/queue.h>
 
 #include <net/if.h>
-#include <net/if_var.h>
 #include <net/if_types.h>
 #include <net/route.h>
 #include <net/if_dl.h>
@@ -248,9 +247,7 @@ lladdropt_length(struct sockaddr_dl *sdl)
 {
 	switch (sdl->sdl_type) {
 	case IFT_ETHER:
-#ifdef IFT_IEEE80211
 	case IFT_IEEE80211:
-#endif
 		return (ROUNDUP8(ETHER_ADDR_LEN + 2));
 	default:
 		return (0);
@@ -266,9 +263,7 @@ lladdropt_fill(struct sockaddr_dl *sdl, struct nd_opt_hdr *ndopt)
 
 	switch (sdl->sdl_type) {
 	case IFT_ETHER:
-#ifdef IFT_IEEE80211
 	case IFT_IEEE80211:
-#endif
 		ndopt->nd_opt_len = (ROUNDUP8(ETHER_ADDR_LEN + 2)) >> 3;
 		addr = (char *)(ndopt + 1);
 		memcpy(addr, LLADDR(sdl), ETHER_ADDR_LEN);
diff --git a/usr.sbin/rtsold/probe.c b/usr.sbin/rtsold/probe.c
index 5ec54aa..89a1617a 100644
--- a/usr.sbin/rtsold/probe.c
+++ b/usr.sbin/rtsold/probe.c
@@ -40,7 +40,6 @@
 #include <sys/queue.h>
 
 #include <net/if.h>
-#include <net/if_var.h>
 #include <net/if_dl.h>
 
 #include <netinet/in.h>
diff --git a/usr.sbin/rtsold/rtsold.c b/usr.sbin/rtsold/rtsold.c
index a97b884..bba15bb 100644
--- a/usr.sbin/rtsold/rtsold.c
+++ b/usr.sbin/rtsold/rtsold.c
@@ -38,7 +38,6 @@
 
 #include <net/if.h>
 #include <net/if_dl.h>
-#include <net/if_var.h>
 
 #include <netinet/in.h>
 #include <netinet/icmp6.h>
diff --git a/usr.sbin/smbmsg/smbmsg.c b/usr.sbin/smbmsg/smbmsg.c
index 425b782..4e7e609 100644
--- a/usr.sbin/smbmsg/smbmsg.c
+++ b/usr.sbin/smbmsg/smbmsg.c
@@ -163,7 +163,8 @@ do_io(void)
 	}
 	if (iflag == 1 && oflag == -1) {
 		/* command + 1 byte input: read byte op. */
-		c.data.byte_ptr = ibuf;
+		c.rbuf = ibuf;
+		c.rcount = iflag;
 		if (ioctl(fd, SMB_READB, &c) == -1)
 			return (-1);
 		printf(fmt, (int)(unsigned char)ibuf[0]);
@@ -171,11 +172,12 @@ do_io(void)
 		return (0);
 	} else if (iflag == -1 && oflag == 1) {
 		/* command + 1 byte output: write byte op. */
-		c.data.byte = obuf[0];
+		c.wdata.byte = obuf[0];
 		return (ioctl(fd, SMB_WRITEB, &c));
 	} else if (wflag && iflag == 2 && oflag == -1) {
 		/* command + 2 bytes input: read word op. */
-		c.data.word_ptr = &iword;
+		c.rbuf = (char*) &iword;
+		c.rcount = iflag;
 		if (ioctl(fd, SMB_READW, &c) == -1)
 			return (-1);
 		printf(fmt, (int)(unsigned short)iword);
@@ -183,15 +185,16 @@ do_io(void)
 		return (0);
 	} else if (wflag && iflag == -1 && oflag == 2) {
 		/* command + 2 bytes output: write word op. */
-		c.data.word = oword;
+		c.wdata.word = oword;
 		return (ioctl(fd, SMB_WRITEW, &c));
 	} else if (wflag && iflag == 2 && oflag == 2) {
 		/*
 		 * command + 2 bytes output + 2 bytes input:
 		 * "process call" op.
 		 */
-		c.data.process.sdata = oword;
-		c.data.process.rdata = &iword;
+		c.wdata.word = oword;
+		c.rbuf = (char*) &iword;
+		c.rcount = iflag;
 		if (ioctl(fd, SMB_PCALL, &c) == -1)
 			return (-1);
 		printf(fmt, (int)(unsigned short)iword);
@@ -199,8 +202,8 @@ do_io(void)
 		return (0);
 	} else if (iflag > 1 && oflag == -1) {
 		/* command + > 1 bytes of input: block read */
-		c.data.byte_ptr = ibuf;
-		c.count = iflag;
+		c.rbuf = ibuf;
+		c.rcount = iflag;
 		if (ioctl(fd, SMB_BREAD, &c) == -1)
 			return (-1);
 		for (i = 0; i < iflag; i++) {
@@ -212,8 +215,8 @@ do_io(void)
 		return (0);
 	} else if (iflag == -1 && oflag > 1) {
 		/* command + > 1 bytes of output: block write */
-		c.data.byte_ptr = obuf;
-		c.count = oflag;
+		c.wbuf = obuf;
+		c.wcount = oflag;
 		return (ioctl(fd, SMB_BWRITE, &c));
 	}
 
diff --git a/usr.sbin/sysrc/sysrc b/usr.sbin/sysrc/sysrc
index bcb2178..67b5e14 100644
--- a/usr.sbin/sysrc/sysrc
+++ b/usr.sbin/sysrc/sysrc
@@ -80,7 +80,7 @@ die()
 #
 usage()
 {
-	f_err "Usage: %s [OPTIONS] name[[+]=value] ...\n" "$pgm"
+	f_err "Usage: %s [OPTIONS] name[[+|-]=value] ...\n" "$pgm"
 	f_err "Try \`%s --help' for more information.\n" "$pgm"
 	die
 }
diff --git a/usr.sbin/tzsetup/tzsetup.c b/usr.sbin/tzsetup/tzsetup.c
index 71ba63b..fc80364 100644
--- a/usr.sbin/tzsetup/tzsetup.c
+++ b/usr.sbin/tzsetup/tzsetup.c
@@ -475,7 +475,7 @@ read_zones(void)
 	FILE		*fp;
 	struct continent *cont;
 	size_t		len;
-	char		*line, *tlc, *coord, *file, *descr, *p;
+	char		*line, *tlc, *file, *descr, *p;
 	int		lineno;
 
 	fp = fopen(path_zonetab, "r");
@@ -495,7 +495,7 @@ read_zones(void)
 		if (strlen(tlc) != 2)
 			errx(1, "%s:%d: invalid country code `%s'",
 			    path_zonetab, lineno, tlc);
-		coord = strsep(&line, "\t");	 /* Unused */
+		/* coord = */ strsep(&line, "\t");	 /* Unused */
 		file = strsep(&line, "\t");
 		p = strchr(file, '/');
 		if (p == 0)
diff --git a/usr.sbin/uhsoctl/uhsoctl.c b/usr.sbin/uhsoctl/uhsoctl.c
index 21b6220..686d45f 100644
--- a/usr.sbin/uhsoctl/uhsoctl.c
+++ b/usr.sbin/uhsoctl/uhsoctl.c
@@ -37,7 +37,6 @@
 
 #include <arpa/inet.h>
 #include <net/if.h>
-#include <net/if_var.h>
 #include <net/if_dl.h>
 #include <net/route.h>
 #include <netinet/in.h>
diff --git a/usr.sbin/vidcontrol/vidcontrol.c b/usr.sbin/vidcontrol/vidcontrol.c
index 3001f69..cbf8f47 100644
--- a/usr.sbin/vidcontrol/vidcontrol.c
+++ b/usr.sbin/vidcontrol/vidcontrol.c
@@ -1085,12 +1085,16 @@ show_mode_info(void)
 	printf("---------------------------------------"
 	       "---------------------------------------\n");
 
+	memset(&_info, 0, sizeof(_info));
 	for (mode = 0; mode <= M_VESA_MODE_MAX; ++mode) {
 		_info.vi_mode = mode;
 		if (ioctl(0, CONS_MODEINFO, &_info))
 			continue;
 		if (_info.vi_mode != mode)
 			continue;
+		if (_info.vi_width == 0 && _info.vi_height == 0 &&
+		    _info.vi_cwidth == 0 && _info.vi_cheight == 0)
+			continue;
 
 		printf("%3d (0x%03x)", mode, mode);
     		printf(" 0x%08x", _info.vi_flags);
@@ -1343,7 +1347,7 @@ main(int argc, char **argv)
 	if (vt4_mode)
 		opts = "b:Cc:fg:h:Hi:M:m:pPr:S:s:T:t:x";
 	else
-		opts = "b:Cc:df:g:h:Hi:l:LM:m:pPr:S:s:T:t:x";
+		opts = "b:Cc:dfg:h:Hi:l:LM:m:pPr:S:s:T:t:x";
 
 	while ((opt = getopt(argc, argv, opts)) != -1)
 		switch(opt) {
diff --git a/usr.sbin/wpa/Makefile.crypto b/usr.sbin/wpa/Makefile.crypto
index 3049011..46cd9ef 100644
--- a/usr.sbin/wpa/Makefile.crypto
+++ b/usr.sbin/wpa/Makefile.crypto
@@ -53,7 +53,8 @@ SRCS+=	tls_openssl.c
 .endif
 
 .if defined(CONFIG_INTERNAL_AES)
-SRCS+=	aes-internal.c \
+SRCS+=	aes-unwrap.c aes-wrap.c \
+	aes-internal.c \
 	aes-internal-dec.c \
 	aes-internal-enc.c
 .endif
@@ -92,7 +93,7 @@ SRCS+=	md4-internal.c
 .endif
 
 .if defined(CONFIG_INTERNAL_MD5)
-SRCS+=	md5-internal.c
+SRCS+=	md5.c md5-internal.c
 .endif
 
 .if defined(NEED_FIPS186_2_PRF)
diff --git a/usr.sbin/wpa/hostapd/Makefile b/usr.sbin/wpa/hostapd/Makefile
index 4621ad3..04fbc4d 100644
--- a/usr.sbin/wpa/hostapd/Makefile
+++ b/usr.sbin/wpa/hostapd/Makefile
@@ -7,15 +7,17 @@
 	${WPA_DISTDIR}/src/drivers
 
 PROG=	hostapd
-SRCS=	accounting.c aes-wrap.c ap_config.c ap_drv_ops.c ap_mlme.c authsrv.c \
-	base64.c beacon.c chap.c common.c config_file.c ctrl_iface.c \
+SRCS=	accounting.c aes-omac1.c ap_config.c ap_drv_ops.c ap_mlme.c authsrv.c \
+	base64.c beacon.c bss_load.c chap.c common.c config_file.c \
+	ctrl_iface.c \
 	ctrl_iface_ap.c driver_common.c l2_packet_freebsd.c driver_bsd.c \
 	drivers.c drv_callbacks.c eap_common.c eap_peap_common.c \
 	eap_register.c eap_server.c eap_server_methods.c eap_user_db.c \
 	eapol_auth_dump.c eapol_auth_sm.c eloop.c gas.c gas_serv.c hostapd.c \
-	hs20.c http_client.c http_server.c httpread.c ieee802_11_auth.c \
+	hs20.c http_client.c http_server.c httpread.c \
+	hw_features_common.c ieee802_11_auth.c \
 	ieee802_11_common.c ieee802_11_shared.c ieee802_1x.c ip_addr.c \
-	main.c md5.c ms_funcs.c os_unix.c peerkey_auth.c pmksa_cache_auth.c \
+	main.c ms_funcs.c os_unix.c peerkey_auth.c pmksa_cache_auth.c \
 	preauth_auth.c radius.c radius_client.c radius_das.c sta_info.c \
 	tkip_countermeasures.c upnp_xml.c utils.c uuid.c vlan_init.c \
 	wpa_auth.c wpa_auth_glue.c wpa_auth_ie.c wpa_common.c wpa_debug.c \
@@ -64,10 +66,9 @@ CFLAGS+=-DDPKCS12_FUNCS \
 	-DEAP_SERVER_TLS \
 	-DEAP_SERVER_TTLS \
 	-DEAP_TLS_FUNCS \
-	-DEAP_SERVER_WSC \
-	-DCONFIG_NO_DUMP_STATE
-SRCS+=	dump_state.c \
-	eap_server_gtc.c \
+	-DEAP_SERVER_WSC
+
+SRCS+=	eap_server_gtc.c \
 	eap_server_identity.c \
 	eap_server_md5.c \
 	eap_server_mschapv2.c \
diff --git a/usr.sbin/wpa/ndis_events/ndis_events.c b/usr.sbin/wpa/ndis_events/ndis_events.c
index 9c6e9de..b61fd0a 100644
--- a/usr.sbin/wpa/ndis_events/ndis_events.c
+++ b/usr.sbin/wpa/ndis_events/ndis_events.c
@@ -49,7 +49,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/sysctl.h>
 #include <net/if.h>
 #include <net/if_dl.h>
-#include <net/if_var.h>
 
 #include <netinet/in.h>
 #include <arpa/inet.h>
diff --git a/usr.sbin/wpa/wpa_passphrase/Makefile b/usr.sbin/wpa/wpa_passphrase/Makefile
index c138481..aaf5c19 100644
--- a/usr.sbin/wpa/wpa_passphrase/Makefile
+++ b/usr.sbin/wpa/wpa_passphrase/Makefile
@@ -5,11 +5,10 @@
 .PATH.c:${WPA_SUPPLICANT_DISTDIR}
 
 PROG=	wpa_passphrase
-SRCS=	common.c md5-internal.c md5.c os_unix.c sha1-internal.c sha1-pbkdf2.c sha1.c \
-	wpa_passphrase.c
+SRCS=	common.c md5-internal.c md5.c os_unix.c sha1-internal.c sha1-pbkdf2.c \
+	sha1.c wpa_passphrase.c
 
-CFLAGS+= -DINTERNAL_SHA1
-CFLAGS+= -DINTERNAL_MD5
+CFLAGS+= -DCONFIG_CRYPTO_INTERNAL -DINTERNAL_SHA1 -DINTERNAL_MD5
 
 LIBADD+=	util
 
diff --git a/usr.sbin/wpa/wpa_supplicant/Makefile b/usr.sbin/wpa/wpa_supplicant/Makefile
index dd40766..ecbacb1 100644
--- a/usr.sbin/wpa/wpa_supplicant/Makefile
+++ b/usr.sbin/wpa/wpa_supplicant/Makefile
@@ -8,14 +8,17 @@
 	${WPA_DISTDIR}/src/drivers
 
 PROG=	wpa_supplicant
-SRCS=	aes-unwrap.c base64.c blacklist.c bss.c common.c config.c \
+SRCS=	ap_drv_ops.c base64.c blacklist.c bss.c common.c config.c \
 	config_file.c ctrl_iface.c ctrl_iface_unix.c driver_bsd.c \
 	driver_common.c driver_ndis.c driver_wired.c drivers.c \
 	eap_register.c eloop.c events.c gas.c gas_query.c hs20.c \
 	hs20_supplicant.c http_client.c http_server.c httpread.c \
-	ieee802_11_common.c interworking.c l2_packet_freebsd.c main.c \
-	md5.c notify.c offchannel.c os_unix.c peerkey.c pmksa_cache.c \
-	preauth.c scan.c upnp_xml.c uuid.c wpa.c wpa_common.c wpa_debug.c \
+	hw_features_common.c \
+	ieee802_11_common.c ieee802_11_shared.c \
+	interworking.c l2_packet_freebsd.c main.c \
+	notify.c offchannel.c os_unix.c peerkey.c pmksa_cache.c \
+	preauth.c scan.c upnp_xml.c uuid.c wmm_ac.c \
+	wpa.c wpa_common.c wpa_debug.c \
 	wpa_ft.c wpa_ie.c wpa_supplicant.c wpabuf.c wpas_glue.c wps.c \
 	wps_attr_build.c wps_attr_parse.c wps_attr_process.c \
 	wps_common.c wps_dev_attr.c wps_enrollee.c wps_registrar.c \
diff --git a/usr.sbin/wpa/wpa_supplicant/Packet32.c b/usr.sbin/wpa/wpa_supplicant/Packet32.c
index 876417e..8e7da03 100644
--- a/usr.sbin/wpa/wpa_supplicant/Packet32.c
+++ b/usr.sbin/wpa/wpa_supplicant/Packet32.c
@@ -49,7 +49,6 @@ __FBSDID("$FreeBSD$");
 #include <sys/fcntl.h>
 #include <net/if.h>
 #include <net/if_dl.h>
-#include <net/if_var.h>
 
 #include <netinet/in.h>
 #include <arpa/inet.h>